ST-SEC-008 - SecureString Variable Usage

Rule ID: ST-SEC-008

Scope: Workflow

Description

This rule checks the variable usage of SecureString type in the workflow.

Recommendation

After a SecureString is retrieved, it is recommended to be logged into applications with the help of Type Secure Text activity which sends a SecureString to a UI element, and Send Keys Secure activity for Terminals.

It is important for the credential to not be used for any purpose other than the intended one. Variables holding such secure strings should be defined at the narrowest scope possible.

Arguments should ideally not be used for passing credentials from one workflow to another. Read more about the SecureString class in the official Microsoft documentation.

Modifying the Rule

In the Project Settings window, select the Workflow Analyzer tab. Find the rule and select the rule, as in the image below:

By default, this rule checks for the Variable depth usage of 1. The maximum limit is 3. This means that the rule checks whether variables of SecureString type are defined in an activity found inside a layer of two container activities. For example, a SecureString type variable inside a Type Secure Text activity defined in a Do container, and all part of a Sequence.

To change the depth, simply type in another number smaller than or equal to 3 in this field.

Reset to Default

By default, the rule checks for one Variable depth usage. To return to the default value after modifications were made, simply right-click the rule and select Reset to default.

The Default action is also reset to its default value Error.