You recently took a position as a Cyber Security Analyst for a small software company. The software company currently has three commercially available off-the-shelve software products that are sold to businesses and/or organizations (B2B). They can range from small companies to very large companies including those in the Fortune 500. One of their products has been identified by CERT to have several vulnerabilities. Since this event occurred, the Chief Cyber Security Officer (CCSO) suspects that not enough security is built into the software development process used at the company. You have been asked by the CCSO to conduct a cyber attack surface analysis on one of their web-based products in an effort to improve the software development process.
For assignment purposes, select a multi-layered (presentation layer, business layer and database layer) web-based open source project in place of the software company’s web-based product. In place of the open source project, if you are familiar with another web-based system that meets the requirements, then discuss using it with your instructor.
Assume that the presentation layer resides on a dedicated server in the company’s DMZ. The other two layers of the software are behind the corporate firewall and can reside on one or two dedicated servers. The web application is accessible from the Internet and is browser based. Firefox, Chrome, Internet Explorer and Safari are the supported browsers.
You will conduct a cyber attack surface analysis on the system/application you selected. Focus your analysis from an external cyber attack point of view. It is not necessary to focus on end user cyber attacks (social engineering attacks, etc.). You will define the cyber attack surface (do not forget to consider the O/S’s used and Web server), you will identify and map the cyber attack vectors, categorize what was identified, and pick at least 3 use-cases that validates your understanding of the attack surface. Finally, determine if the attack surface can be reduced. All of this analysis will help the CCSO understand the cyber attack surface for the product. In an effort to help with your analysis, you can use an open source or commercially available attack surface analyzer to help with your analysis. Finally, this assignment should also include a graphical representation of the attack surface with descriptions (Consider using Viso for this part of the assignment).
Your analysis paper should be at least 5–6 pages of content (exclusive of cover sheet etc.), using Times New Roman font style, 12pt, double-spaced, using correct APA formatting, and include a cover sheet, table of contents, abstract, and reference page(s). Be sure to document your content with proper APA in text citations that match your reference list.