From 70b9a77d30075212196674e97e547bde16498fd6 Mon Sep 17 00:00:00 2001 From: Marcin Zelent Date: Fri, 25 May 2018 11:42:04 +0200 Subject: Corrected some errors --- synopsis.tex | 210 ++++++++++++++++++++++++++++++----------------------------- 1 file changed, 108 insertions(+), 102 deletions(-) diff --git a/synopsis.tex b/synopsis.tex index ae90841..4d9a7cf 100644 --- a/synopsis.tex +++ b/synopsis.tex @@ -23,25 +23,25 @@ \section{Introduction} One of the mandatory activities in Computer Science course at Erhvervsakademi -Sjælland is an individual specialization project. In this project, student has +Sjælland is an individual specialization project. In this project, a student has to choose a subject, which was not presented during the lectures, research it -and describe it in the synopsis. +and describe it in a synopsis. I have chosen application security as the topic that I want to learn more about. -Application security is an umbrella term for all of the measures that need to +Application security is an umbrella term for all of the measures that need to be taken in order to make a secure application. That means finding, fixing and preventing security vulnerabilities. I decided to work on this subject, because in previous semesters we have learned -how to make programs, services and web applications, but we did not learn how to -make them safe from exploitation. It is important, since a potential attacker +how to make programs, services, and web applications, but we did not learn how +to make them safe from exploitation. It is important since a potential attacker could use it to gain access to the system without authorization, retrieve some sensitive data, abuse or even break the system. This could lead to some serious consequences. \section{Problem definition} -During my research I am going to delve deeper into the subject of application +During my research, I am going to delve deeper into the subject of application security, its meaning, principles, importance in the modern software development, as well as practical implementation. The main question which I would like to answer is: @@ -57,7 +57,7 @@ following problems: \item What is application security? \item What are the most common application security flaws and attack techniques? - \item How software developers can prevent them? + \item How can software developers prevent them? \end{itemize} \newpage @@ -69,13 +69,13 @@ The method which I am going to use in my research consists of a few activities: \begin{itemize} \item Getting general information about application security using all of the sources available on the internet, this could include - reading articles, watching videos, talks, lectures and and - online courses - \item Reading books related to the subject of application security + reading articles, watching videos, talks, lectures and online + courses. + \item Reading books related to the subject of application security. \item Finding detailed descriptions and tutorials about specific attack - techniques + techniques. \item Trying to reproduce the attacks by creating vulnerable - applications, exploiting them and trying to make them secure + applications, exploiting them and trying to make them secure. \end{itemize} \section{Plan} @@ -105,13 +105,13 @@ before the deadline, I have prepared a plan which I will try to follow: The first week is a project initialization phase, in which I will describe what I am going to do in the next weeks, how and why. -In the second and third week I will focus on learning, finding information and +In the second and third week, I will focus on learning, finding information and describing the results of it. I am also going to work on the practical part of this project, which is learning how to use different attack techniques and creating examples for the presentation of them. -In the last week I will look back at my work, write summary of it, as well as -reflections on the research process. I will also proof read my synopsis and +In the last week, I will look back at my work, write a summary of it, as well as +my reflections on the research process. I will also proofread my synopsis and correct any mistakes that I find. \newpage @@ -147,9 +147,10 @@ common form of application. Every day billions of people are searching for information using Google, browsing Facebook and watching videos on YouTube. All of these are web applications. What makes them different from regular websites is that they do not just display static content, but allow users to interact -with them. Users can for example sign up, log in, write comments, upload videos. -A lot of sensitive data is flowing between the user and the system. This, and -being publicly available, makes them frequent targets of the attackers. +with them. Users can, for example, sign up, log in, write comments, upload +videos. A lot of sensitive data is flowing between the user and the system. +This, and being publicly available, makes them frequent targets of the +attackers. Other common targets are mobile and desktop applications, with the emphasis on the first one. Just like web apps they are usually part of a bigger system and @@ -159,7 +160,7 @@ holes, easy gateways leading to the precious resources. \newpage -\subsection{Why application security is important?} +\subsection{Why is application security important?} There should be no doubt about the importance of application security. There are many reasons for that. @@ -169,7 +170,7 @@ the attackers, if the application becomes compromised. This could include names, addresses, login credentials, credit card information, bank account details, private photos and many more information about the users of the system. By breaking into the unprotected system, attackers could also gain access to -company's internal data: important documents, list of employees, private keys +company's internal data: important documents, list of employees, private keys, and passwords. All this information could be useful for them in various ways. For example, it could be used to buy things or perform financial operations without the knowledge of the account owner. The data could be sold on the black @@ -182,33 +183,34 @@ losses of money and force changes of plans. Another issue is the possibility of gaining access to functionality reserved only for privileged users, such as moderators and administrators. It could allow -not only for data theft, but also for damaging the system and stored +not only for data theft but also for damaging the system and stored information. It would allow for spreading viruses and malware throughout the whole platform, creating a botnet, spambots, mining cryptocurrencies and making it vulnerable to further attacks. It would be sufficient just to insert malicious code into the application and infest its users. -Other, non-technical risks include the possible lost of trust from customers, +Other, non-technical risks include the possible loss of trust from customers, who value privacy and wish their data to be secure. It could even lead to -lawsuits, like it happened to Yahoo which got sued over security breaches that -took place between 2013 and 2016. Private information of at least 3 billions -users were exposed, it included names e-mail addresses, dates of birth, +lawsuits like it happened to Yahoo which got sued over security breaches that +took place between 2013 and 2016. Private information of at least 3 billion +users was exposed, it included names, e-mail addresses, dates of birth, phone numbers, passwords, etc. It cost the company hundreds of millions of dollars and damaged the brand image permanently. On the other hand, providing good security could help in gaining new clients. I