Clarification: V2 Text Statement "Business logic includes"

[ajayojha]

Business logic includes limits and controls to detect and prevent automated attacks, such as
continuous small funds transfers or adding a million friends one at a time.

"Business logic includes" these are security controls not purely the part of business logic.

[elarlang]

Those are logical controls that are part of security controls. In the past I have recommended removing the "business" from this, as it leads people to think mostly of $$$, but as the definition defines, what "business logic" in this document includes, I don't see the problem to solve here.

[ajayojha]

Please correct me if I am wrong, As far as I know the that business logic is about domain-specific rules and detection/prevention of automated attacks is more of a security/anti-fraud subsystem.
I think the clarity is missing between business logic vs security controls.

[narfbg]

Security controls should be built into the business logic, not separated from it, that is the point.

[ajayojha]

Security controls should be built into the business logic, not separated from it, that is the point.

Rate-limiting, bot detection, WAF rules, API gateways, DDoS protection, etc. are all security controls and are explicitly separate from business-logic code.

[elarlang]

I repeat my answer: #3293 (comment)

[ajayojha]

I have re-analyzed your pointing out comment and try to find out the definition of "business logic" in the asvs 5 document.

The term “business logic” is not defined anywhere in the standard. please point me to the exact section so I can refer it accordingly.

Even if a private definition exists elsewhere, it doesn't solve my concern clarity and architecture neutrality, because in industry-usage “business logic” and “security controls” are not synonymous and ASVS is a public standard, If ASVS relies on a non-standard or private definition of “business logic,” it creates ambiguity.

Please correct me if my re-analysis is incorrect.

[elarlang]

The term “business logic” is not defined anywhere in the standard. please point me to the exact section so I can refer it accordingly.

That is getting a bit silly here, as you literally quoted it when you opened the issue.

Please stop pointing to "the industry" or whatever abstract mechanism, as this is the one and only source of truth. There is no such precise single source of thing as "the industry". There are always different opinions, different point of views, different stacks, different eras. To serve own opinion as "the industry" and the only truth just does not fly.

And in general, I'm not afraid to go against "the industry" definitions, if I have valid reasons to do so.

If something is not clear or not understandable, it needs attention. At the moment, I don't think we have a problem that affects understanding the document.

[ajayojha]

That is getting a bit silly here, as you literally quoted it when you opened the issue.

The text I quoted is from the Control Objective section of V2. Control objectives is describing a goal, not defining the term “business logic.” and also do not establish what “business logic” means within ASVS.

I'm not afraid to go against "the industry" definitions, if I have valid reasons to do so.

This is perfectly fine, but the valid reasons I couldn't find the document, such as if you refer to this link business logic definition copied from Business Logic Wikipedia, you will see detailed information about the business logic definition. If there are valid reasons for ASVS to use the term differently, that reasoning should be documented so that readers do not misinterpret the term.

My goal is not to dispute the control objective intent but to highlight that the wording. The concern is not “industry definitions”, it is ASVS clarity and architectural neutrality.

[narfbg]

That's an unnecesarily rigid viewpoint @ajayojha, but I think the disagreement is coming from something else that you're insisting on for no obvious reason - this "architectural neutrality", for which there is no conflicting "industry" definition.

You seem to have the belief that security controls must be isolated in their own domain, or that every domain is completely sovereign. That's not realistic.

[ajayojha]

That's an unnecesarily rigid viewpoint @ajayojha

Could you explain specifically which part of my viewpoint is “rigid”? If you can share some practical scenarios or examples where my interpretation fails.

this "architectural neutrality", for which there is no conflicting "industry" definition.

Just to alignment with your perspective, could you please clarify what you mean by “architectural neutrality” in this context?

[elarlang]

This is perfectly fine, but the valid reasons I couldn't find the document, such as if you refer to this link business logic definition copied from Business Logic Wikipedia, you will see detailed information about the business logic definition. If there are valid reasons for ASVS to use the term differently, that reasoning should be documented so that readers do not misinterpret the term.

I can not see any conflicting information from there.

I still can not see a problem to solve, this issue can be closed out. If @tghosth wants to fine-tune any definition, then he can take it over.

[ajayojha]

This is perfectly fine, but the valid reasons I couldn't find the document, such as if you refer to this link business logic definition copied from Business Logic Wikipedia, you will see detailed information about the business logic definition. If there are valid reasons for ASVS to use the term differently, that reasoning should be documented so that readers do not misinterpret the term.

I can not see any conflicting information from there.

I still can not see a problem to solve, this issue can be closed out. If @tghosth wants to fine-tune any definition, then he can take it over.

Thank You @elarlang