You are tasked with examining Artemis Financial’s web-based software application by conducting a vulnerability assessment. Implementing what you have learned so far and using the supporting materials provided to assist you, review and analyze the security vulnerabilities specific to Artemis Financial’s web-based software application and document the following in the Vulnerability Assessment Report Template.
- Interpreting Client Needs: Review the scenario to determine your client’s needs and potential threats and attacks associated with their application and software security requirements. Document your findings in your Vulnerability Assessment Report. Consider the following regarding how companies protect against external threats based on the scenario information:
- What is the value of secure communications to the company?
- Are there any international transactions that the company produces?
- Are there governmental restrictions about secure communications to consider?
- What external threats might be present now and in the immediate future?
- What are the “modernization” requirements that must be considered, such as the role of open source libraries and evolving web application technologies?
- Areas of Security: Use what you’ve learned in Step 1 and refer to the Vulnerability Assessment Process Flow Diagram provided. Think about the functionality of the software application to identify which areas of security are applicable to Artemis Financial’s web application. Document your findings in your Vulnerability Assessment Report and justify your reasoning for why each area is relevant to the software application.
*Please note: Not all seven areas of security identified in the Vulnerability Assessment Process Flow Diagram may be applicable for the company’s software application.
- Manual Review: Refer to the seven security areas outlined in the Vulnerability Assessment Process Flow Diagram. Use what you’ve learned in Steps 1 and 2 to guide your manual review. Identify all vulnerabilities in the code base by manually inspecting the code. Document your findings in your Vulnerability Assessment Report. Be sure to include a description identifying where the vulnerabilities are found (specific class file, if applicable).
- Static Testing: Integrate the dependency check plug-in into Maven by following the instructions outlined in the tutorial provided. Run a dependency check on Artemis Financial’s software application to identify all security vulnerabilities in the code. Specifically, record the following from the dependency check report in your Vulnerability Assessment Report:
- The names or vulnerability codes of the known vulnerabilities
- A brief description and recommended solutions provided by the dependency check report
- Attribution (if any) that documents how this vulnerability has been identified or documented previously
- Mitigation Plan: Interpret the results from the manual review and static testing report. Identify steps to remedy the identified security vulnerabilities by creating an action list that documents how to fix each vulnerability in your Vulnerability Assessment Report.
*Please note: You do not need to fix these vulnerabilities in this project.
