Hulp
Deze pagina aan uw boek toevoegen
Boek weergeven (27 pagina's)
Pagina's suggererenSoftware Security/Group 4
Uit Werkplaats
Group nr. 4
Group members:
Topics
Verification Requirements
- V7: Cryptography - The hash functions (MD5), salting, password transfer method (client-side crypto?)
- V9: Data Protection - OWASP: Caching of data (do not cache credit card numbers in forms, do not autocomplete password fields), protection of personal data on the server.
- V10: Communication Security - Mainly TLS security and certificates. Maybe out of scope of phpBB2.
- V11: HTTP Security - Redirects, request methods, encoding and cookies.
Deliverables
- The log should be a chronological list of who has been doing what, with dates.
- Also useful to document decisions on who will be doing what, and by when.
- This should discuss the results of the code scanning. Insofar as possible, put the focus on these from the point of view of the Verfication Requirements your group is looking at, but also point out, but then briefly, findings that might be interesting for other groups.
- Describe your impressions about the tools, in capabilities, limitations, etc.
- Also, did you learn anything about specific security vulnerabilities from using them?
- This should give your verdict for each requirement (Pass/Fail/Don't know) with motivation, and an indication of what you did to reach this verdict.
- Describe the sort of documentation you would have wanted about phpbb, to make your security review easier.
- This can be design decisions, description of the overall architecture and organisation, policies used in the application, styles or guidelines adhered to in the actual coding.
- Reflect on the whole process of doing a code review, or "Application Security Verification", in the way you did.
