From 1b433c36d9b43fd064bac44459ce4136bdbf562c Mon Sep 17 00:00:00 2001 From: Marcin Zelent Date: Thu, 17 May 2018 11:07:12 +0200 Subject: Split lines to max 80 chars --- synopsis.tex | 146 +++++++++++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 112 insertions(+), 34 deletions(-) diff --git a/synopsis.tex b/synopsis.tex index 9592c66..b70418d 100644 --- a/synopsis.tex +++ b/synopsis.tex @@ -17,25 +17,40 @@ \section{Introduction} -One of the mandatory activities in Computer Science course at Erhvervsakademi Sjælland is an individual specialization project. In this project, student has to choose a subject, which was not presented during the lectures, research it and describe it in the synopsis. - -I have chosen application security as the topic that I want to learn more about. Application security is an umbrella term for all of the measures that need to taken in order to make a secure application. That means finding, fixing and preventing security vulnerabilities. - -I decided to work on this subject, because in previous semesters we have learned how to make programs, services and web applications, but we did not learn how to make them safe from exploitation. It is important, since a potential attacker could use it to gain access to the system without authorization, retrieve some sensitive data, abuse or even break the system. This could lead to some serious consequences. +One of the mandatory activities in Computer Science course at Erhvervsakademi +Sjælland is an individual specialization project. In this project, student has +to choose a subject, which was not presented during the lectures, research it +and describe it in the synopsis. + +I have chosen application security as the topic that I want to learn more about. +Application security is an umbrella term for all of the measures that need to +taken in order to make a secure application. That means finding, fixing and +preventing security vulnerabilities. + +I decided to work on this subject, because in previous semesters we have learned +how to make programs, services and web applications, but we did not learn how to +make them safe from exploitation. It is important, since a potential attacker +could use it to gain access to the system without authorization, retrieve some +sensitive data, abuse or even break the system. This could lead to some serious +consequences. \section{Problem definition} -During my research I am going to delve deeper into the subject of application security, its meaning, principles, importance in the modern software development, as well as practical implementation. +During my research I am going to delve deeper into the subject of application +security, its meaning, principles, importance in the modern software +development, as well as practical implementation. The main question which I would like to answer is: \medskip {\large How to make a secure application?} \medskip -In order to give an answer to it, I will first need to find solutions to the following problems: +In order to give an answer to it, I will first need to find solutions to the +following problems: \begin{itemize} \item What is application security? - \item What are the most common application security flaws and attack techniques? + \item What are the most common application security flaws and attack + techniques? \item How software developers can prevent them? \end{itemize} @@ -45,35 +60,52 @@ In order to give an answer to it, I will first need to find solutions to the fol The method which I am going to use in my research consists of a few activities: \begin{itemize} - \item Getting general information about application security using all of the sources available on the internet, this could include reading articles, watching videos, talks, lectures and and online courses + \item Getting general information about application security using all + of the sources available on the internet, this could include + reading articles, watching videos, talks, lectures and and + online courses \item Reading books related to the subject of application security - \item Finding detailed descriptions and tutorials about specific attack techniques - \item Trying to reproduce the attacks by creating vulnerable applications and exploiting them + \item Finding detailed descriptions and tutorials about specific attack + techniques + \item Trying to reproduce the attacks by creating vulnerable + applications and exploiting them \end{itemize} \section{Plan} -To optimize my work and to make sure I will deliver the finishied synopsis before the deadline, I have prepared a plan which I will try to follow: +To optimize my work and to make sure I will deliver the finishied synopsis +before the deadline, I have prepared a plan which I will try to follow: \begin{table}[h] \centering \begin{tabular}{@{}lll@{}} \toprule - Week 18 & Week 19 \& 20 & Week 21 \\ \midrule - Writing introduction & Doing an actual research & Writing conclusion \\ - Defining the problem & Describing the work & Reflecting on the work \\ - Choosing the method & Preparing examples & Putting finishing touches \\ - Planning & & \\ \bottomrule + Week 18 & Week 19 \& 20 & Week 21 + \\ \midrule + Writing introduction & Doing an actual research & Writing + conclusion \\ + Defining the problem & Describing the work & Reflecting on + the work \\ + Choosing the method & Preparing examples & Putting + finishing touches \\ + Planning & & + \\ \bottomrule \end{tabular} \caption{Week plan} \label{my-label} \end{table} -The first week is a project initialization phase, in which I will describe what I am going to do in the next weeks, how and why. +The first week is a project initialization phase, in which I will describe what +I am going to do in the next weeks, how and why. -In the second and third week I will focus on learning, finding information and describing the results of it. I am also going to work on the practical part of this project, which is learning how to use different attack techniques and creating examples for the presentation of them. +In the second and third week I will focus on learning, finding information and +describing the results of it. I am also going to work on the practical part of +this project, which is learning how to use different attack techniques and +creating examples for the presentation of them. -In the last week I will look back at my work, write summary of it, as well as reflections on the research process. I will also proof read my synopsis and correct any mistakes that I find. +In the last week I will look back at my work, write summary of it, as well as +reflections on the research process. I will also proof read my synopsis and +correct any mistakes that I find. \newpage @@ -81,21 +113,63 @@ In the last week I will look back at my work, write summary of it, as well as re \subsection{What is application security?} -Application security describes activities that need to be taken into consideration by a developer who creates an application which will be available to a broader group of users. Having a large userbase means that there is a risk that, among the regular users, there might be some individuals with malicious intents. - -These people, usually called attackers, could try to access sensitive data stored in the database connected to the application or use functions that normally are only available for the users with special privileges. Such data could include for example a list of users, some important documents or money in a bank account. Administrator