Initial organization stub

diff --git a/report/organization.tex b/report/organization.tex
index 77eca21..13c1b42 100644 (file)
--- a/report/organization.tex
+++ b/report/organization.tex
@@ -1,6 +1,34 @@
+%
+% (TODO write out: dsprenkels)
+%
+% This document describes our security analysis of the (?) CMS according to the OWASP ASVS (v3.0.1), as well as an analysis of Fortify's results compared to our findings \& the OWASP ASVS categories.
+%
+% Outline: first our analysis, then a summary of Fortify's analysis and how it compares to ours etc., then some reflection.
 
-(TODO write out:)
+% E.g. did you split the work by files in the code, or by category of security requirements? Did you double-check important findings? Or did you use several pairs of eyeballs on the same code/ security requirement, in the hope that more eyeballs spot more problems? (How) did you integrate using the static code analysis tools into this process? Did you use other tools and methods?
+% Have you tried to run the application? (If so, was this useful, and did you find than running the application was helpful to then review the code, understanding its functionality better? But you might want to dicuss this in the Reflection section.)
 
-This document describes our security analysis of the (?) CMS according to the OWASP ASVS (v3.0.1), as well as an analysis of Fortify's results compared to our findings \& the OWASP ASVS categories.
+\section{Organization}
 
-Outline: first our analysis, then a summary of Fortify's analysis and how it compares to ours etc., then some reflection.
+Each of us has initially set up the CMS and made ourselves familiar with the
+CMS. We have chosen to split the work by category of security requirements in
+the OWASP Application Security Verification Standard. We set the goal to perform
+a sound level 2 audit on the software.
+
+% Initial approach
+We were quickly set up and started to do each own parts of the audit by hand.
+For each OWASP ASVS item specific to certain mechanisms (like login and input
+validation), we would take the source code of the CMS and follow the control
+flow to see if the application satisfies the security requirement. For more
+general requirements, we could just look at the code that is responsible for
+this requirement (like the \code{Response} class in the case of HTTP security).
+When we had found that a requirement was not satisfied, we elaborate shortly
+and move on.
+
+This went well, because with five people the individual workload is just not
+that big. Furthermore, finding vulnerabilities is a lot easier that verifying the security in a lot of cases. This speeds up the auditing process, because
+the CMS turned out to not satisfy the ASVS in most cases.
+
+% TODO(dsprenkels) Use of Fortify
+% TODO(dsprenkels) Running the application
+% TODO(dsprenkels) Double-checking process (see V2.2 as example)