2

There is a data flow of incoming files (from untrusted, external sources), that get whitelisted by a kind of application layer firewall.

Is there a common name for the state of the files before they get whitelisted? Can you provide some source like NIST?

Improve this question
3
  • In limbo.
    – Adi
    Commented Mar 14, 2013 at 17:59
  • 1
    On a more serious note. Black-listed = explicitly distrusted, white-listed = explicitly trusted. Before white-listed is basically implicitly black-listed, so it's just untrusted.
    – Adi
    Commented Mar 14, 2013 at 18:04
  • 1
    @Adnan I disagree. Limbo could be valid in some cases. In other cases, filtering is applied for a case-by-case basis unless something is blacklisted (reject immediately) or white-listed (accept without filtering).
    – Jeff Ferland ♦
    Commented Mar 14, 2013 at 18:27

3 Answers 3

Reset to default
1

Greylisting is used in the context of an antispam technique for emails. It somehow uses this terminology:

  • Whitelist: people who are allowed in, unconditionally.
  • Blacklist: people who are rejected, whatever they claim.
  • Greylist: the other people, who are temporarily rejected but will be whitelisted (i.e. allowed to enter) if they bother to come back later, thereby proving that they are not a low-grade one-shot spammer.
Improve this answer
2
  • Hey Tom, thanks for your input! I've thought of Greylisting before but am quite unsure. A greylisted sender is an entity who is actively denied, albeit temporarily. I'm more looking for a term that describes an untrusted message that just comes in. Maybe "untrusted" is good already but I assume there's some nifty vocabulary out there ...
    – mdo
    Commented Mar 14, 2013 at 21:19
  • @mdo Unlisted data? I think when you get something like this where we're all struggling for an answer, the answer is to call it something you like on Twitter and see if it becomes a popular name.
    – Jeff Ferland ♦
    Commented Mar 19, 2013 at 14:20
1

Here's a summary of my findings.

  • incoming data from an untrusted source is untrusted data or unvalidated data
  • it passes a trust boundary on its way into a trusted environment or trusted domain
  • a validation process can label the data trusted, in my question I described a use case where this state is named "whitelisted"
  • while validating the data upon violations the system can
    • block the data
    • sanitize the data

Some references ...

IDS00-J. Sanitize untrusted data passed across a trust boundary:

Many programs accept untrusted data originating from unvalidated users, network connections, and other untrusted sources and then pass the (modified or unmodified) data across a trust boundary to a different trusted domain.

Input Validation and Data Sanitization:

Data received by a component from a source outside the component's trust boundary can be malicious and can result in an injection attack

Please see the given data flow diagram, where the incoming data is labeled "untrusted data".

Trust Boundary Violation:

A trust boundary can be thought of as line drawn through a program. On one side of the line, data is untrusted. On the other side of the line, data is assumed to be trustworthy. The purpose of validation logic is to allow data to safely cross the trust boundary--to move from untrusted to trusted.

So Adnan, your conclusion "untrusted" seems pretty legit. And Saladin, "un-sanitized" seems to fit somehow but I do like "untrusted" more because it seems to be more common and sanitization does not happen all the time.

Improve this answer
1

I did some research on your question and found the word unsanitized for your question. When this word is linked to policy it makes more sense, because this is where you define what is acceptable and what input is not acceptable.

Also, depending upon the application design an unsanitized may get rejected. No direct logic should apply to data that is in rest or fly before it enters the application logical flow, all the checks if this input is valid or not should happen in pre-validation phase.

Improve this answer
5
  • Thanks for your input, too! I assume you mean "un-sanitized" (typo)? Could you provide some links where this term was used?
    – mdo
    Commented Mar 19, 2013 at 20:42
  • I guess there is NIST and owasp that uses the term. csrc.nist.gov/staff/Singhal/using-attack-graphs-forensic-examinations.pdf Owasp owasp.org/index.php/…
    – Saladin
    Commented Mar 19, 2013 at 20:45
  • I heard the term "sanitization" before, but connected it more to the process of cleaning individual parameters or values. I've now looked after it but I think it does not fit exactly. See my update to the question.
    – mdo
    Commented Mar 20, 2013 at 7:27
  • @mdo I see no update?
    – Saladin
    Commented Mar 20, 2013 at 7:46
  • Yes, sorry, meanwhile I've found some more hints. I'll add an answer that sums up my findings in a few minutes.
    – mdo
    Commented Mar 20, 2013 at 7:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .