report/report.tex

   1 %&report
   2 \begin{document}
   3 \maketitleru[course={Software Security}]
   4
   5
   6 \tableofcontents
   7
   8
   9 \section{Organization}
  10 \input{organization.tex}
  11
  12 \section{Our security analysis of the \CMS{}}
  13
  14   \subsection{General comments}
  15
  16   \begin{itemize}
  17     \item
  18       The \CMS{} comes equipped with an installer script, which is incredibly insecure, but which the author of the \CMS{} assumes the admin will remove after installation. If we regard this installer script as part of our subject matter, the analysis becomes incredibly simple, as it directly makes the \CMS{} vulnerable to server side code execution, \SQL{} injections, etc. Therefore, we regard the installer script as a special case, and we assume that it is indeed removed after installation. The analysis, then, treats the \CMS{} as it is after installation.
  19
  20     \item
  21       A number of times in our analysis, the OWASP ASVS requirements will require certain overridable server settings or request/response headers to be correcty set. The \CMS{} is in principle able to set these parameters, for example by adding directives to an Apache \code{.htaccess} file, or explicitly setting certain \HTTP{} response headers. However, the \CMS{} does not do so, and therefore relies upon the server's default settings. In these cases, we consider the requirements failed, although one might contest this on the principle of separation of concerns.
  22   \end{itemize}
  23
  24
  25   \renewcommand\thesubsection{V\arabic{subsection}}
  26
  27   \subsection{Authentication}
  28   \input{v2_authentication}
  29
  30   \subsection{Session Management}
  31   \input{v3_session.tex}
  32
  33   \subsection{Access Control}
  34   \input{v4_access.tex}
  35
  36   \subsection{Input Validation \& Output Encoding/Escaping}\label{sec:v6}
  37   \input{v5_input.tex}
  38
  39   \addtocounter{subsection}{1}
  40
  41   \subsection{Cryptography at rest}
  42   \input{v7_cryptography.tex}
  43
  44   \subsection{Error Handling \& logging}
  45   \input{v8_error.tex}
  46
  47   \subsection{Data Protection}
  48   \input{v9_data.tex}
  49
  50   \addtocounter{subsection}{2}
  51   \subsection{\HTTP{} Security}
  52   \input{v11_httpsec.tex}
  53
  54   \addtocounter{subsection}{4}
  55   \subsection{Files and Recourses}
  56   TODO
  57
  58   \renewcommand\thesubsection{\arabic{section}.\arabic{subsection}}
  59
  60
  61 \section{Summary and short reflection on Fortify's analysis}
  62 \input{fortify.tex}
  63
  64 \section{General reflection}
  65 \input{reflection.tex}
  66
  67 \end{document}