---
# System prepended metadata

title: HEIG-VD SEC Laboratory KING

---

# HEIG-VD SEC Laboratory KING
Authors: **Bécaud Arthur**, **Egremy Bruno**

## Brainstorming
Objectives:
- Secure KING.
- Write a high level report of the changes made.

Existing:
- Database containing the grades of students.
- De-serialization of the database.

Authentication:
- [ ] User attributes: 
    - Unique username as email (username@school.com)
    - password hashed
    - role
- [ ] Challenge-response (mac rand challenge using password hash as key)
- [ ] Administrator register users (username/email only), an email is send to  the user to set its own password through a password reset-ish process.
- [ ] A registered user can login like in any normal system (username&passphrase).

Authorization:
- [ ] User roles:
    - Student
        - Can see its own grades
    - Teacher
        - Can see/add/remove students grades
    - Administrator (?)
        - Can add users and set a role to them

Logging:

- [ ] Sensitive data excluded!
- [ ] In general:
    - Log content: When, What, Where, Who ?
    - Authentication successes and failures.
    - Unauthorized tentative access (exemple: student try to access teacher interface).
    - Authorization: log access control failures with who tried what (anonymize if necessary) (warn level of higher).
    - Critical operation:
        - Creation/deletion of users.
        - Privilege change.
        - Key/password change.
        - Add/Remove grades.
    - Input/output validation failures (detect exploit attempts).
    - All legal functionalities (term of use, permission rights, etc).
    - Privacy laws:
        - Forbids storing data about users without their consent.
        - Illegal to monitor employees without their consent.
- [ ] By roles:
    - Student
        - Nothing
    - Teacher
        - Grades modifications
            - Add
            - Edit
            - Remove 
    - Administrator
        - Users modifications
            - New user
            - Remove user
            - Role modification 

CIA:
- [ ] todo

Error management:
- [ ] Just do it!

Input/output validation:
- [ ] Check password strength
- [ ] Check unique username
- [ ] Note value validation [1;6]

Others:
- [ ] When a user log in, the associated interface is shown:
    - Student interface
    - Teacher interface
    - Administrator interface
- [ ] Any user can reset his password