design and development of a web application that tests the security of a database-driven website

There is one assignment for this module which comprises of two components: Part A is The design and development of a web application that tests the security of a database-driven website 

Part A

As the digital economy is growing so too is the opportunity for cyber criminals to exploit vulnerabilities in web systems and access, damage, and destroy data and hardware. According to The Cyber Security Regulation and Incentives Review UK (2016), " businesses continue to experience cyber security breaches with one in four businesses detecting a breach in the last year. The nature of the attacks mean many businesses may not know their IT systems have been breached. Cyber security breaches have a direct impact on the organisations affected, including lost staff time dealing with the breach and disruption to other work. As a result businesses incur financial losses with the average direct costs of a breach estimated at £36,000 for large businesses and £3,100 for micro/small businesses. The most costly single breach identified in the Cyber Security Breaches Survey was £3,000,000 for a large firm. There can also be reputational costs with a number of firms experiencing a loss of customers following a breach. Breaches can also result in consumers and other businesses incurring costs, for example through fraud. A US survey found that the majority of consumers affected by a breach reported they incurred costs with an estimated average of $500, while less than a third said they incurred no costs. Despite the potentially significant financial costs, evidence shows businesses are not doing to enough to protect themselves, both in terms of technical controls but also risk management and incident response. Whilst 69% of businesses say their senior management consider cyber security is a very or fairly high priority for their organisation just over half (51%) of all businesses have actually taken recommended actions to identify cyber risks, and only 10% have a formal incident management plan. Only 17% of businesses say their staff attended some form of training on cyber security in the last 12 months"

In this scenario, your role is a trainee Web Application Security Analystat a UK based technology consultancy firm. You have been assigned a task to carry out a security analysis of your client website and backend SQL database attached to a website containing possible security vulnerabilities; your answer can make reasonable assumptions.

Deliverables

The web/application security testing includes the following components: 

Setup a fully functioning Web Application:  (Screenshot for every steps must be provided)

• PHP

• MySQL

• Apache Server 

Web Application Security Testing:

• Nmap scanning

• Wireshark Sniffing

• SQL Injection using SQLMAP 

Web Application Security Model:

• Firewalls

• IDS/IPS

• Encryption

Note: 

Task A is worth 60% of the overall assignment. The marking criteria are outlined below.

Marking Criteria Task A

Assignment Checklist