SECURITY VERSLAG versie 1.2
SECURITY VERSLAG
versie 1.2
, Security verslag KBS ICTM1G versie : 1.2
Versiebeheer
Versie Datum
1.0 20-12-2017
1.1 05-01-2018
1.2 06-01-2018
1
, Security verslag KBS ICTM1G versie : 1.2
Inhoud
Versiebeheer...................................................................................................................... 1
Samenvatting..................................................................................................................... 4
Inleiding.............................................................................................................................. 5
1. Kwalitatieve Risicoanalyse.............................................................................................. 6
1.1: Uitleg gebruikte termen en risico’s...........................................................................6
1.2: Tabel kwalitatieve risicoanalyse...............................................................................7
1.3 Risico’s met betrekking tot Beschikbaarheid.............................................................8
1.3.1 SQL Injection....................................................................................................... 8
1.3.2 DDOS-aanval....................................................................................................... 8
1.3.3 Uploaden van kwaadaardige bestanden.............................................................8
1.4 Risico’s met betrekking tot Integriteit.......................................................................8
1.4.1 SQL-Injection....................................................................................................... 8
1.5 Risico’s met betrekking tot Vertrouwelijkheid...........................................................8
1.5.1 SQL-Injection....................................................................................................... 8
1.5.2 Directory Traversal.............................................................................................9
1.5.3 Brute Force......................................................................................................... 9
1.5.4 Uploaden van kwaadaardige bestanden.............................................................9
2. Ingebouwde maatregelen...............................................................................................9
2.1 maatregelen met betrekking tot beschikbaarheid.....................................................9
2.1.1 SQL Injection....................................................................................................... 9
2.1.2 Uploaden van kwaadaardige bestanden.............................................................9
2.2 Maatregelen met betrekking tot integriteit................................................................9
2.2.1 Man in the middle...............................................................................................9
2.3 Maatregelen met betrekking tot vertrouwelijkheid....................................................9
2.3.1 Directory Traversal.............................................................................................9
3. Advies voor onopgeloste risico’s...................................................................................10
3.1 DDoS Aanval............................................................................................................ 10
3.2 Brute-Force.............................................................................................................. 10
3.3 XSS.......................................................................................................................... 10
Geïmplementeerde beveiligingsaspecten Route11...........................................................11
Captcha......................................................................................................................... 11
HTTPS............................................................................................................................ 11
SQL injection................................................................................................................. 13
Directory traversal......................................................................................................... 13
Wachtwoord Hash......................................................................................................... 13
Bestandenbeveiliging...................................................................................................... 13
Inlogsysteem.................................................................................................................... 15
2
SECURITY VERSLAG
versie 1.2
, Security verslag KBS ICTM1G versie : 1.2
Versiebeheer
Versie Datum
1.0 20-12-2017
1.1 05-01-2018
1.2 06-01-2018
1
, Security verslag KBS ICTM1G versie : 1.2
Inhoud
Versiebeheer...................................................................................................................... 1
Samenvatting..................................................................................................................... 4
Inleiding.............................................................................................................................. 5
1. Kwalitatieve Risicoanalyse.............................................................................................. 6
1.1: Uitleg gebruikte termen en risico’s...........................................................................6
1.2: Tabel kwalitatieve risicoanalyse...............................................................................7
1.3 Risico’s met betrekking tot Beschikbaarheid.............................................................8
1.3.1 SQL Injection....................................................................................................... 8
1.3.2 DDOS-aanval....................................................................................................... 8
1.3.3 Uploaden van kwaadaardige bestanden.............................................................8
1.4 Risico’s met betrekking tot Integriteit.......................................................................8
1.4.1 SQL-Injection....................................................................................................... 8
1.5 Risico’s met betrekking tot Vertrouwelijkheid...........................................................8
1.5.1 SQL-Injection....................................................................................................... 8
1.5.2 Directory Traversal.............................................................................................9
1.5.3 Brute Force......................................................................................................... 9
1.5.4 Uploaden van kwaadaardige bestanden.............................................................9
2. Ingebouwde maatregelen...............................................................................................9
2.1 maatregelen met betrekking tot beschikbaarheid.....................................................9
2.1.1 SQL Injection....................................................................................................... 9
2.1.2 Uploaden van kwaadaardige bestanden.............................................................9
2.2 Maatregelen met betrekking tot integriteit................................................................9
2.2.1 Man in the middle...............................................................................................9
2.3 Maatregelen met betrekking tot vertrouwelijkheid....................................................9
2.3.1 Directory Traversal.............................................................................................9
3. Advies voor onopgeloste risico’s...................................................................................10
3.1 DDoS Aanval............................................................................................................ 10
3.2 Brute-Force.............................................................................................................. 10
3.3 XSS.......................................................................................................................... 10
Geïmplementeerde beveiligingsaspecten Route11...........................................................11
Captcha......................................................................................................................... 11
HTTPS............................................................................................................................ 11
SQL injection................................................................................................................. 13
Directory traversal......................................................................................................... 13
Wachtwoord Hash......................................................................................................... 13
Bestandenbeveiliging...................................................................................................... 13
Inlogsysteem.................................................................................................................... 15
2
