Added a chapter analysing Fortify's results; some general beautification; modified...

[ssproject1617.git] / report / report.tex

diff --git a/report/report.tex b/report/report.tex
index d294062..c832984 100644 (file)
--- a/report/report.tex
+++ b/report/report.tex
@@ -1,51 +1,67 @@
 %&report
 \begin{document}
 \maketitleru[course={Software Security}]
+
+
+\tableofcontents
+
+
 \section{Organization}
 \input{organization.tex}
 
-\section{Verdict}
+\section{Our security analysis of the CMS}
+
+  \subsection{General comments}
+
+  \begin{itemize}
+    \item
+      The CMS comes equipped with an installer script, which is incredibly insecure, but which the author of the CMS assumes the admin will remove after installation. If we regard this installer script as part of our subject matter, the analysis becomes incredibly simple, as it directly makes the CMS vulnerable to server side code execution, SQL injections, etc. Therefore, we regard the installer script as a special case, and we assume that it is indeed removed after installation. The analysis, then, treats the CMS as it is after installation.
+
+    \item
+      A number of times in our analysis, the OWASP ASVS requirements will require certain overridable server settings or request/response headers to be correcty set. The CMS is in principle able to set these parameters, for example by adding directives to an Apache \code{.htaccess} file, or explicitly setting certain HTTP response headers. However, the CMS does not do so, and therefore relies upon the server's default settings. In these cases, we consider the requirements failed, although one might contest this on the principle of separation of concerns.
+  \end{itemize}
+
+
+  \renewcommand\thesubsection{V\arabic{subsection}}
 
-\subsection*{General comments}
+  \subsection{Authentication}
+  \input{v2_authentication}
 
-\begin{itemize}
-  \item \TODO{} (Kelley) Server instellingen.
-  \item \TODO{} (Kelley) \code{installer.php} and server code execution.
-\end{itemize}
+  \subsection{Session Management}
+  \input{v3_session.tex}
 
-\addtocounter{subsection}{1}
-\subsection{Authentication}
-\input{v2_authentication}
+  \subsection{Access Control}
+  \input{v4_access.tex}
 
-\subsection{Session Management}
-\input{v3_session.tex}
+  \subsection{Input Validation \& Output Encoding/Escaping}
+  \input{v5_input.tex}
 
-\subsection{Access Control}
-\input{v4_access.tex}
+  \addtocounter{subsection}{1}
 
-\subsection{Input Validation \& Output Encoding/Escaping}
-\input{v5_input.tex}
+  \subsection{Cryptography at rest}
+  \input{v7_cryptography.tex}
 
-\addtocounter{subsection}{1}
+  \subsection{Error Handling \& logging}
+  \input{v8_error.tex}
 
-\subsection{Cryptography at rest}
-\input{v7_cryptography.tex}
+  \subsection{Data Protection}
+  \input{v9_data.tex}
 
-\subsection{Error Handling \& logging}
-\input{v8_error.tex}
+  \addtocounter{subsection}{2}
+  \subsection{HTTP Security}
+  \input{v11_httpsec.tex}
 
-\subsection{Data Protection}
-\input{v9_data.tex}
+  \addtocounter{subsection}{4}
+  \subsection{Files and Recourses}
+  TODO
 
-\addtocounter{subsection}{2}
-\subsection{HTTP Security}
-\input{v11_httpsec.tex}
+  \renewcommand\thesubsection{\arabic{section}.\arabic{subsection}}
 
-\addtocounter{subsection}{4}
-\subsection{Files and Recourses}
 
+\section{Summary and short reflection on Fortify's analysis}
+\input{fortify.tex}
 
-\section{Reflection}
+\section{General reflection}
 \input{reflection.tex}
 
 \end{document}