search

Deeds101 / CYBR8420-project

3 stars 5 forks source link

Use/Misuse Case 5 (RBAC) #15

Closed DoomDragoon closed 9 months ago

Deeds101 commented 9 months ago

Iteration 1

Image

Deeds101 commented 9 months ago

Iteration 2

Image

Deeds101 commented 9 months ago

Iteration 3

Image

DoomDragoon commented 9 months ago

I think this is pretty good. You have a nice progression. I would be more specific with actors names, like nurse, or ransomware attacker etc. like our professor mention in our check in. Im sure he will be looking to take points off for being too generic. IN our lectures, it also noted that is shouldn't be too technical. I had to google what RBAC meant. I always take the 'Would a 5-year-old understand this' approach. Other than some labels, I think you may be done!

kdherrm88 commented 9 months ago

This works well. You progress through the steps showing how it is able to perform the needed steps to create more security for the product.

Deeds101 commented 9 months ago

Final Itteration

Image

Thank you guys, I was having a brain freeze on how to label the threat actors as well as the clients.

Deeds101 commented 9 months ago

https://forum.itflow.org/d/345-allow-technicians-to-add-clients https://github.com/itflow-org/itflow/issues/530

This is where I got the idea for the IDOR vulnerability.

Atmcalpine commented 9 months ago

Would phishing campaigns, password spraying, or man-in-the-middle attacks be additional attack methods that made be used to exploit the Identity Management Platform?

Deeds101 commented 9 months ago

Final with Revisions

Image

Deeds101 commented 9 months ago

https://github.com/itflow-org/itflow/issues/673

Reasoning for SQL injection in Use case

Deeds101 commented 9 months ago

A Security Researcher discovered that the code is vulnerable with a SQL injection on the client page, this got fixed. There was also a IDOR vulnerability with the fact that people could visit vital site pages if they had a valid URL, This got put in the release milestone 1.0.