Reference no: EM134010343

Assessment: DevSecOps: Secure Web Application Development

Web Application Security, Code and report

Overview

In this group DevSecOps assignment, your task is to design and implement a secure web application based on several key topics as covered in the unit. Concepts related to Software Engineering and secure development practices may support the implementation process.

Assessment Structure

This assignment consists of a 3000-word deliverable.

A demonstration of the working has to be presented in class in Week 12. You will work in groups of 3-4 students.

The following list of tasks needs to be completed for this assignment:

Task 1: Implement an Axum API (RUST), add all required dependencies and make sure that it is tested for errors. Hint: you will have to add all required dependencies and configure the CORS middleware (Provide installation details and summary in the report)

Task 2: Setup a React SPA (front-end) - run and test the same

Task 3: (Pipelines) Connect the front-end from task 2 to the back-end Axum API by invoking the back-end with basic HTTP requests (remember, you are working with a web server here). Knowledge of Application Programming And Software Help may assist with API integration and testing.

Task 4: Identify 4 common threats against web-based applications based on the OWASP model

Task 5: Implement threat detection in Axum [Hint: cargo clippy, axum-auth, tower-http and tower::limit::RateLimit, Rust crates (tokio, sqlx, jsonwebtoken)] - these Rust crates will ensure security of the web application that is being hosted on the Axum server

Task 6: Find ‘SonarQube Scanner' - and install it

Test out a sample web application that you will create to host on the Axum server, on Sonarqube, generate a report and add to your submission. Topics from Computer Science and Data Communication And Networking can also support understanding of secure server deployment.

Task 7: Prepare and submit the report (3000 words):

Submission Format:

The report must include the following components:

Executive Summary (250 words) (Project overview and security posture)

Threat Model Analysis (750 words)
Threat identification with OWASP context.
Detailed impact assessment (CIA triad)
Threat prioritization and mitigation mapping.

Security Development Pipeline (750 words)
Complete architecture documentation (front-end, back-end, integration).
Security mechanisms implementation details.
Development best practices integration.

Static Code Analysis Results (750 words)
SonarQube scan overview and findings.
Vulnerability explanation and remediation.
Code quality improvement and future recommendations.

Reflection s Learning Outcomes (500 words)
Implementation challenges and trade-offs.
Secure coding principles application.