
Aggregate user requests
-------

**Description:**

verify the system can protect against aggregation or continuous access to functions,  
resources, or data. For example, possibly by the use of a resource governor to limit the 
number of edits per minute in order to to prevent an automatic attack


**Solution:**

Verify the application has the ability to detect and alert on abnormal numbers of requests 
for information or processing high value transactions for that user role, such as screen 
scraping, automated use of web service extraction, or data loss prevention. For example, 
the average user should not be able to access more than 5 records per hour or 30 records 
per day, or add 10 friends to a social network per minute.


	