report/report.tex

   1 %&report
   2 \begin{document}
   3 \maketitleru[course={Software Security}]
   4
   5
   6 \tableofcontents
   7
   8
   9 \section{Organization}
  10 \input{organization.tex}
  11
  12 \section{Our security analysis of the CMS}
  13
  14   \subsection{General comments}
  15
  16   \begin{itemize}
  17     \item
  18       The CMS comes equipped with an installer script, which is incredibly insecure, but which the author of the CMS assumes the admin will remove after installation. If we regard this installer script as part of our subject matter, the analysis becomes incredibly simple, as it directly makes the CMS vulnerable to server side code execution, SQL injections, etc. Therefore, we regard the installer script as a special case, and we assume that it is indeed removed after installation. The analysis, then, treats the CMS as it is after installation.
  19
  20     \item
  21       A number of times in our analysis, the OWASP ASVS requirements will require certain overridable server settings or request/response headers to be correcty set. The CMS is in principle able to set these parameters, for example by adding directives to an Apache \code{.htaccess} file, or explicitly setting certain HTTP response headers. However, the CMS does not do so, and therefore relies upon the server's default settings. In these cases, we consider the requirements failed, although one might contest this on the principle of separation of concerns.
  22   \end{itemize}
  23
  24
  25   \renewcommand\thesubsection{V\arabic{subsection}}
  26
  27   \subsection{Authentication}
  28   \input{v2_authentication}
  29
  30   \subsection{Session Management}
  31   \input{v3_session.tex}
  32
  33   \subsection{Access Control}
  34   \input{v4_access.tex}
  35
  36   \subsection{Input Validation \& Output Encoding/Escaping}
  37   \input{v5_input.tex}
  38
  39   \addtocounter{subsection}{1}
  40
  41   \subsection{Cryptography at rest}
  42   \input{v7_cryptography.tex}
  43
  44   \subsection{Error Handling \& logging}
  45   \input{v8_error.tex}
  46
  47   \subsection{Data Protection}
  48   \input{v9_data.tex}
  49
  50   \addtocounter{subsection}{2}
  51   \subsection{HTTP Security}
  52   \input{v11_httpsec.tex}
  53
  54   \addtocounter{subsection}{4}
  55   \subsection{Files and Recourses}
  56   TODO
  57
  58   \renewcommand\thesubsection{\arabic{section}.\arabic{subsection}}
  59
  60
  61 \section{Summary and short reflection on Fortify's analysis}
  62 \input{fortify.tex}
  63
  64 \section{General reflection}
  65 \input{reflection.tex}
  66
  67 \end{document}