all the questions are on this website: https://owasp.org/www-project-juice-shop/ Part A: Mapping the information assets and analyzing threats on the app 30) points for a group of 2 and 45 points for a group of 3

1. Mapping the information assents of the Shop Juice app

Define the information assets of the app, the security properties that need to be protected for each of the information assets (meaning confidentiality, completeness, and availability)

• Explain why the Seciruty properties you chose to protect must be protected, and why the Seciruty properties you did not choose do not need to be protected.
• In your explanations, please include the damage that can be caused to the organization as a result of breaching these Security properties.
• In addition, assign a weight of 1 to 5 (0- not important at all, 1, slightly important., 5 critical for the organization) to each of these Security properties. Remember that you cannot assign 5 to everything therefore prioritize the Security Properties for each of the information assets.

1. Mapping the threats on the assets of the Shop Juice app

Define the main threats on the information assets of the app that you defined in the previous section (at least one main threat for each information asset), and define for each threat:

• What is the possible vulnerability that results in the threat
• What is the current status of the information for which there is a threat (at use, at rest, at transit)
• What is the attackers motivation (what is the attackers gain as a result of a successful attack)
• What is the damage that will be caused to the organization as a result of a breach of the information assets
• Suggest information security mechanisms that can cope with the threat

Part B: Access Control Policy in Rest at Data status

• Define the actions to be performed for each Data asset defined above
• Define the different position holders in the system and specify which permissions are required in order for them to perform their job based on the List Privileges Principle.

According to the definitions above, define the Access Control Policy in the RBAC model: Note for parts A and B:

• For the purpose of analyzing the threats, assuming of course it is a real website.
• 4 Information assets as well as threats on 4 information assets.

Part C: The permission system implemented in the application - What is the permission system that eas implemented in the application, specify the way in which it is implemented.

• What are the permissions for the different files in the app
• What are the permissions for the different beings based on the app database.

Find vulnerabilities in the permission system implemented in the system, and explain each vulnerability you found Explain in the permissions system implemented in the system, and for any vulnerability, you found explained (5 points) Find Vulnerabilities in the permission system implemented in the system, and for each vulnerability you found explain the following: (5 points)

• The vulnerability
• How can it be used to cause damage
• How can the vulnerability be fixed

Part D: Dividing the app into modules that will run as separate processes:

• Specify into each modules (that will run as separate processes) would you divide the app in order to realize the Lease privileges principle? Explain the logic behind this division. Specify which users should have access to each of the modules. Explain.
• Specify the permissions you would give each module (regarding the database and regarding the file system) and explain how these permissions match the Least privileges principle. Explain how this division reduces the possible damage in case of vulnerability of the code. Refer to the JuiceShop system in the explanation.

Part E: XSS - Is the app exposed to an XSS attack? Please find 2

• If so, explain in which requests there is exposure and why
  • In addition, explain to which XSS type it refers
• If there is partial protection, explain what is protected and what isnt protected.
• If not, explain which mechanism (or mechanisms) are used for protection from the attack
  • Explain the application method of the mechanism (or mechanisms)
• If required, explain how you would improve the protection against an XSS attack

Part F: Injection Attacks (not including XSS) - Is the application exposed to injection attacks? (10 points for a group of 2 and 15 points for a group of 3)

• If yes, explain in which requests there is exposure and why
  • Explain the damage that can be caused
• If there is partial protection, explain what is protected and what isnt protected
• If not, explain in which mechanism (or mechanisms) is used for protection against the attack
  • Explain the application of the mechanism (or mechanisms)
• If required, explain how you would improve the protection against an XSS attack

Note: it is enough to find 2 Injections Attacks Part G: Mapping packages with Known vulnerabilities Run a tool that detects packages with known vulnerabilities about the software in order to locate such packages, each student must locate at least two vulnerable packages. For each such vulnerable package, answer the following questions:

• The package name
• The package version
• The vulnerability existing in the package
• In which version of the package was the vulnerability fixed
• What is the use of the package within the app
• If and how can the vulnerability of the package be utilized

Notes:

• Analysis of 2 vulnerable packages

Attachments:

app.docx