Read the following information about a typical dental practice:* Family Dental has two offices in the same city — the North office and the South office. These offices offer the same dental services to patients. Patients can make appointments to either office at their convenience to see the dentist of their choice. Both offices are similarly equipped.* The professional staff includes the dentists, hygienists, dental mechanics, and administrative staff(receptionist, billing clerk, and office manager).* Each Family Dental office has a waiting area served by a receptionist who uses a computer to check in patients, schedule one of the examination rooms, and answer the phone. The waiting room has a door opening to the outside. A second door admits patients into the rest of the facility. Background music plays inside the waiting area. There is also a large aquarium on display.* Each examination area is partitioned off from the adjacent ones. Each has a computer and LCD screen used to pull up patient information and record new dental data such as x-ray interpretations, examination and test results, and procedures done for the patient. A low level sound masking system is installed in this area.* After their treatment the patient visits the billing clerk’s desk, which of course has a computer and a printer. Here patients pay (cash co-pay, credit card, or check), insurance information is verified, and an appointment is made. This clerk also mails out postcard appointment reminders, and answers the phone.* The Family Dental dentists share a private office that has a computer and a printer. Here they can review patient data, access the Internet, and exchange email with their patients, colleagues, and acquaintances.* A database server containing patient data sits in a closet, next to a small tape library used for backup.Next to it sits a VPN server, firewall/router, and DSL modem connected to the Internet. The VPN serveraccepts incoming connections from the dentist’s home computers. It also provides a permanent VPN connection between the North and South Offices. In this way, all patient data is available at all times at either office.* Most patient data is stored electronically on the database server, but some data such as x-rays and third party labs results are still in physical form. Family Dental also depends on third party service providers to build crowns, braces, false teeth, soft dental protectors, and such. Information is exchanged with service providers using telephone, fax, letter, and email.* The network infrastructure’s management and maintenance is outsourced.* Family Dental also maintains an informative web site to advertise its practice. The site is remotely hosted.-------------------------------------------------------------------------Answer the following questions in essay style. Make any sensible assumptions necessary in order to continue your analysis.Q1 What is all the electronic and non-electronic private health information (ePHI) that is stored, processed, and transmitted at the Family Dentals two offices?Q2 Assess the practice’s organization. Where is it most likely HIPAA compliant? What changes should be made to move the practice closer to compliance?Q3 Assess the practice’s physical and technical safeguards. Where is it most likely HIPAA compliant? Whatchanges should be made to move the practice closer to compliance?Q4 Family Dental exchanges data with service providers and uses a third party to manage its IT infrastructure. What administrative and organizational safeguards should the practice expect these providers to adhere to?

Overview:This homework will demonstrate your knowledge of testing security controls aligned with Inputvalidation and business logic. You will also use the recommended OWASP testing guide reporting format to report your test findings.Assignment: Total 100 pointsUsing the readings from weeks 7 and 8 as a baseline, analyze, test and document the results for the tutoring web application found on the SDEV virtual machine. Use both manual means and automated tools (e.g., ZAP). The latter will enable you to discover more information than a cursory manual examination. Specific tests to be conducted include:1. Testing for Reflected Cross site scripting (OTG-INPVAL-001) What is the importance of testing for this vulnerability? How many occurrences of the vulnerability did an automated scan discover? What is your recommendation to address any issues? Can you place a simple JavaScript alert (e.g., DeleteSession.php as an example)?2. Testing for Stored Cross site scripting (OTG-INPVAL-002) What is the importance of testing for this vulnerability? What happens when you attempt to add a pop-up window (e.g., <script>alert(document.cookie)</script>) to the email input field within the “index.html” field? Can you introduce Stored Cross site scripting?3. Testing for SQL Injection (OTG-INPVAL-005) Did your manual and automated testing discover any SQL Injection vulnerabilities – if so, how many? (Note: There should be at least one occurrence). Name two or more steps you can take according to the reading to resolve the issue. Fix and test at least one occurrence of the vulnerabilities – displaying your resulting source code and output results.4. Testing for Code Injection (OTG-INPVAL-012) What is the importance of testing for this vulnerability? What are at least two measures you can take to remediate this issue? Can you input some simple html code or exploit Remote File Inclusion (RFI)?5. Test business logic data validation (OTG-BUSLOGIC-001) What are at least two examples of business logic errors? This could be from various input forms or areas you discovered in previous HW assignments. How can you mitigate against such errors?6. Test integrity checks (OTG-BUSLOGIC-003) Do Drop down menus exist and are they sufficient for the application? Why does the use of drop-down menus help mitigate against this risk? Does your manual or automated scan reveal the use of password “AUTOCOMPLETE”? What issue, if any, does the use of AUTOCOMPLETE pose?7. Test defenses against application misuse (OTG-BUSLOGIC-007) What is the importance of testing for this vulnerability? Can adding additional characters in input fields cause unexpected results? Verify for at least two instances.General GuidelinesYou should document the results for the tests, your comments, and recommendations for improved security for each security control tested in a word or PDF document. The format of your document should be the format that is recommended in chapter 5 of the OWASP testing guide. Provide screen captures and descriptions of your tests conducted. Discuss any issues found and possible mitigations.Note: The SDEV Virtual Machine you downloaded and used for SDEV 300. The URL is here if you need to download it again: https://citeapps.umuc.edu/SDEV/ The VM runs on the latest version of Oracle Virtual Box. The directions to reinstall the Tutoring Web Application are also included in the course resources – which also includes any required passwords.Deliverables:You should submit your document by the due date. Your document should be well-organized, use the OWASP recommended reporting format, include all references used and contain minimal spelling and grammar errors.Grading Rubric: Attribute MeetsReflected Cross site scripting10 pointsTests for Reflected Cross site scripting (OTG-INVAL-001) as applied to the sample tutor application. (5 points)Discusses the importance of testing for this vulnerability.(1 point)Discusses and demonstrates if a user can place a simple JavaScript alert.(4 points)Stored Cross site scripting10 pointsTests for Stored Cross site scripting (OTG-INVAL-002) as applied to the sample tutor application.(5 points)Discusses the importance of testing for this vulnerability.(2 points)Discusses and demonstrates if a user can introduce Stored Cross site scripting and attempt to add a pop-up window.(3 points)SQL Injection20 pointsTests for SQL injection (OTG-INPVAL-005) as applied to the sample tutor application.(5 points)Names two or more mitigation steps according to reading or other research.(5 points)Fixes and tests at least one discovered SQL injection - and displays source code changes and resulting test output.(10 points)Code Injection10 pointsTests for Code Injection (OTG-INVAL-012) as applied to the sample tutor application.(5 points)Discusses the importance of testing for this vulnerability.(1 point)Names two or more mitigation steps according to reading or other research.(1 point)Discusses and demonstrates if a user can introduce some simple HTML code and exploit Remote File Inclusion (RFI).(3 points)Business logic data validation10 pointsTests business logic data validation (OTG-BUSLOGIC-001) as applied to the sample tutor application.(5 points)Discusses and demonstrates two or more logic errors. (5 points)Discusses how to mitigate logic errors.(2 points)Integrity checks10 pointsTests integrity checks (OTG-BUSLOGIC-003) as applied to the sample tutor application. (5 points)Discusses and demonstrates if drop-down menus exist and are sufficient for the application. (3 points)Discusses the use of password AUTOCOMPLETE functionality and its importance.(2 points)Defenses against application misuse10 pointsTests defenses against application misuse (OTG-BUSLOGIC-007) as applied to the sample tutor application. (5 points)Discusses the importance of testing for this vulnerability.(1 point)Discusses and demonstrates if additional characters can be added in at least 2 instances to cause unexpected results.(4 points)Documentation and Submission20 pointsDocuments the results for the tests and your comments, and recommendations for improved security for each security control tested in a Word or PDF document.(5 points)Uses the format that is recommended in Chapter 5 of the OWASP testing guide.(5 points)Screen captures are clearly labeled indicating exactly what the screen capture represents. (5 points)Document is well-organized, includes page numbers, includes all references used, and contains minimal spelling and grammatical errors.(5 points)

WEEK 1 ESSAY QUESTIONSInstructions: Answer all questions in a single document. Then submit to the appropriate assignment folder. Each response to a single essay question should be about a half-page in length (about 150 words).1. In this week’s readings, you learned about two methods of risk analysis: quantitative assessment and qualitative assessment. Explain the steps taken to assess a risk from a quantitative perspective where monetary and numeric values are assigned and discuss the formulas used to quantify risk. Then, explain the methods used to assess risk from a qualitative perspective where intangible values are evaluated such as the seriousness of the risk or ramifications to the reputation of the company.2. Domain 1 introduced numerous security terms that are used in assessing risk. Please define the terms vulnerability, threat, threat agent, risk, exposure and control. Then, describe the three different control types and give examples for each.3. After you’ve conducted your risk assessment and determined the amount of total and residual risk, you must decide how to handle it. Describe the four basic ways of handling risk.