Assignment Task
For this assignment you are expected to produce a report, giving details of a security audit of a web application. The audit will be a crystal box test, and you will be supplied with the source code, and the means to run the site.
The application will have several vulnerabilities, from the topics covered during the module, this may not just include technical flaws, such as SQLi, but also legal and ethical factors.
IMPORTANT NOTE: You will not be penalized if you do not find all of the issues. Audit can be difficult, and it seems wrong to penalize you for missing a subtle bug. Marks are given for the justification of audit methods, finding common problems, and the discussion of issues found.
The report should contain the following sections.
Part 1: Audit methods
This section of the report should introduce the audit methods chosen, and provide justification for their choice. Why is this method appropriate for the task? What are the strengths and weaknesses of each of the methods chosen?
You are free to use any audit method you feel is appropriate, this can include (but is not limited to):
• Manual Code Review
• Automated source code scanning
• Automated application scanning
Part 2: Audit Results
This section of the report should present the results of the security audit. You are expected to give an overview of the issues found in the code, along with an analysis of its severity, and suggestions for mitigation.
A suggested format for each issue is:
• Brief description of the problem, and the method used to identify it.
• Analysis of the issue, including discussion of its possible impact and severity.
• Suggestions for mitigation. How could the developers address the problem?
The report should be suitable for a technical audience, you are expected to include a introduction, conclusions and make use of the literature to support your arguments. References should be in the APA format
This document is intended for Coventry University Group students for their own use in completing their assessed work for this module. It must not be passed to third parties or posted on any website.
Page 2 of 8
Submission Instructions:
Submit the coursework by the due date using the link on Aula.
Your assignment should be submitted as a single document (i.e. Word, PDF or Markdown).
If you make use of additional materials (such as Github, or supporting videos) you should include a clear link to the supporting material in your report.
Important: In the case of Github repositories, they should be set to private, with the relevant teaching staff added as collaborators. Having a publicly available repository could lead to an academic misconduct case being raised against you, as people have been known to steal work from other students repos.
Marking and Feedback
How will my assignment be marked?
Your assignment will be marked by the module team
How will I receive my grades and feedback?
Provisional marks will be released once internally moderated
Feedback will be provided by the module team alongside grades release You can access your feedback on turnitin.
What will I be marked against?
Details of the marking criteria for this task can be found at the bottom of this assignment brief.
Assessed Module Learning Outcomes
The Learning Outcomes for this module align to the marking criteria which can be found at the end of this brief. Ensure you understand the marking criteria to ensure successful achievement of the assessment task. The following module learning outcomes are assessed in this task:
1) Critically evaluate a range of encryption and authentication methods for a given set of requirements.
4) Critically evaluate the security of an IT ecosystem.
This document is intended for Coventry University Group students for their own use in completing their assessed work for this module. It must not be passed to third parties or posted on any website.
Page 3 of 8
Assignment Support and Academic Integrity
If you have any questions about this assignment please see the Student Guidance on Coursework for more information.
Spelling, Punctuation, and Grammar:
You are expected to use effective, accurate, and appropriate language within this assessment task.
Academic Integrity:
The work you submit must be your own, or in the case of groupwork, that of your group. All sources of information need to be acknowledged and attributed; therefore, you must provide references for all sources of information and acknowledge any tools used in the production of your work, including Artificial Intelligence (AI). We use detection software and make routine checks for evidence of academic misconduct.
Definitions of academic misconduct, including plagiarism, self-plagiarism, and collusion can be found on the Student Portal. All cases of suspected academic misconduct are referred for investigation, the outcomes of which can have profound consequences to your studies. For more information on academic integrity please visit the Academic and Research Integrity section of the Student Portal.
Support for Students with Disabilities or Additional Needs:
If you have a disability, long-term health condition, specific learning difference, mental health diagnosis or symptoms and have discussed your support needs with health and wellbeing you may be able to access support that will help with your studies.
If you feel you may benefit from additional support, but have not disclosed a disability to the University, or have disclosed but are yet to discuss your support needs it is important to let us know so we can provide the right support for your circumstances. Visit the Student Portal to find out more.
Unable to Submit on Time?
The University wants you to do your best. However, we know that sometimes events happen which mean that you cannot submit your assessment by the deadline or sit a scheduled exam. If you think this might be the case, guidance on understanding what counts as an extenuating circumstance, and how to apply is available on the Student Portal.
This document is intended for Coventry University Group students for their own use in completing their assessed work for this module. It must not be passed to third parties or posted on any website.
Page 4 of 8
浙大学霸代写 加微信 cstutorcs
Assessment Marking Criteria
Audit Methods Aligns to MLO4 Weighting: 40%
Audit Results
Aligns to MLO1 and 4 Weighting : 50%
Report Structure.
Doesn’t align to MLO’s but its important.
Weighting: 10%
80 to 100%
As 70+ with exceptional analysis, and justification of audit methods chosen
As 70+ with exceptional analysis and discussion of issues found.
As 70+ with exceptional presentation and analysis, good use of references to support arguments.
Multiple audit methods chosen covering both static and dynamic analysis.
Clear justification for the methods chosen, taking into account the type of audit, code base used etc. Choice of methods is supported by the literature.
Good analysis of the strengths and weaknesses of the methods chosen, discussion and analysis of how different methods can complement each other, and help provide a more comprehensive test.
Clear subsection, summarising decisions made.
Multiple issues found and discussed using appropriate audit methods.
Clear description of each issue, presenting and analysing the code / design flaws that lead to it.
Clear discussion of the risk associated with the issue. Discussion of the wider security context, supported by the literature. Appropriate risk rating system used
Appropriate suggestions for mitigation given, including suggested fixes for problems.
Clear report structure, headings match the marking criteria. Introduction / Conclusions provide context to the report, giving relevant background to topic, and providing a clear summary of results.
Good use of references to support arguments made.
This document is intended for Coventry University Group students for their own use in completing their assessed work for this module. It should not be passed to third parties or posted on any website.
Page 5 of 8
CS Help, Email: tutorcs@163.com
Clear summary section, highlighting all issues found, and associated risks
Multiple audit methods chosen covering both static and dynamic analysis.
There is some justification for the methods chosen, but it may not take into account the literature / specifics of the audit to be performed.
Good analysis of the strengths and weaknesses of the different methods presented.
Clear sub section, summarising decisions made.
Multiple issues found and discussed, using appropriate audit methods.
Clear description of each issue, presenting the code / design flaws that lead to it.
Clear discussion of the risk associated with the issue. Appropriate risk rating system used
Appropriate suggestions for mitigation given. Suggestions are given in the context of the system
Clear summary section, highlighting all issues found, and associated risks
Clear report structure and presentation.
Appropriate introduction and conclusions, summarising reports contents, wider context of the report discussed.
Good analysis of reports contents, with use of references to support arguments.
One or more audit methods presented. There is a brief description of the method, and some limited justification for the choice / discussion of strengths and weaknesses.
Limited summary section,
Multiple issues found, although audit methods used may be limited, or obvious issues missed.
Good discussion of each issue, overview of the problem is given.
Clear report structure and presentation.
Appropriate introduction and conclusions, summarising reports contents.
Limited use of references to support arguments.
This document is intended for Coventry University Group students for their own use in completing their assessed work for this module. It should not be passed to third parties or posted on any website.
Page 6 of 8
Risk associated with issue is discussed, although this is general with limited context for the site under consideration.
Appropriate suggestions for mitigation given, although these are general, and have limited context for the site under consideration.
Limited / no summary section.
One or more audit methods presented.
Limited discussion and justification of the audit methods.
Limited or no discussion of the strengths and weaknesses of the methods chosen.
Reason for choosing methods is not clear.
Limited number of issues found, issues are limited to only technical problems with the code.
Limited or no discussion of the risk associated with the problem. Appropriate risk rating system not used.
Suggestions for mitigation are generic, and have no context for the site being evaluated.
More than one of:
Poor report structure and presentation
Introduction / conclusions limited to re-iterating coursework brief with no context added.
Limited use of references to support arguments made
Limited attempt at this section.
Limited attempt at this section
Limited number of issues found, no discussion of context for
Poor report structure and presentation,
This document is intended for Coventry University Group students for their own use in completing their assessed work for this module. It should not be passed to third parties or posted on any website.
Page 7 of 8
Code Help, Add WeChat: cstutorcs
One audit method presented, with no justification for the choice.
issue, risk analysis or suggestions for mitigation.
Introduction and conclusions limited to re-iterating the coursework brief
Limited use of references to support arguments
Limited or No attempt at this section
Limited or no attempt at this section
Poor report structure and presentation, literature not used to support arguments made.
This document is intended for Coventry University Group students for their own use in completing their assessed work for this module. It should not be passed to third parties or posted on any website.
Page 8 of 8