Finished organization

diff --git a/report/organization.tex b/report/organization.tex
index 13c1b42..222cfc0 100644 (file)
--- a/report/organization.tex
+++ b/report/organization.tex
@@ -8,10 +8,16 @@
 % E.g. did you split the work by files in the code, or by category of security requirements? Did you double-check important findings? Or did you use several pairs of eyeballs on the same code/ security requirement, in the hope that more eyeballs spot more problems? (How) did you integrate using the static code analysis tools into this process? Did you use other tools and methods?
 % Have you tried to run the application? (If so, was this useful, and did you find than running the application was helpful to then review the code, understanding its functionality better? But you might want to dicuss this in the Reflection section.)
 
-\section{Organization}
 
+% Running the application
 Each of us has initially set up the CMS and made ourselves familiar with the
-CMS. We have chosen to split the work by category of security requirements in
+CMS. This was easy, because one of us had made a \code{Dockerfile} for the
+others to use. This made running and installing the application trivially
+easy. Running the application made us understand the outline and components of
+the application. We could also find some spots were easy to find vulnerabilities
+could be expected. However, looking at the source code was more effective.
+
+We have chosen to split the work by category of security requirements in
 the OWASP Application Security Verification Standard. We set the goal to perform
 a sound level 2 audit on the software.
 
@@ -29,6 +35,14 @@ This went well, because with five people the individual workload is just not
 that big. Furthermore, finding vulnerabilities is a lot easier that verifying the security in a lot of cases. This speeds up the auditing process, because
 the CMS turned out to not satisfy the ASVS in most cases.
 
-% TODO(dsprenkels) Use of Fortify
-% TODO(dsprenkels) Running the application
-% TODO(dsprenkels) Double-checking process (see V2.2 as example)
+% Use of Fortify
+Because we were early on track, most of the audit was already done by when we
+were introduced to the Fortify tool. Nonetheless, we used it to verify our own
+verdicts. Some of us have installed and used the Fortify tool itself. These
+students have exported a PDF report, which the others could then use.
+
+% Double-checking process
+When we finished the report, each of us has reread each others' parts to check
+if things had been missed or reported incorrect. This may not have thorough, but
+because in the end five pairs of eyes have read all verdicts, we trust that, in
+the end, all verdicts are sufficiently checked.