A standard practice for web based tools is to conduct what is known as penetration tests at least once a year. This is a white-hat hacking approach in which a firm is given special permission to try and break into, exploit, or otherwise attempt to break a given product via security vulnerabilities.

• First, we would like students to get familiar with our product. Sign up, play around with it, understand generally how it works.
• Second, students should spend time conducting research on state of the art pen testing technologies. They should look into common vulnerability lists such as OWASP Top 10, and common security tools such as Nmap, Burp Suitar, Nessus, and Wireshark.
• Third, students should have a written attack plan and present it to us so we can confirm we understand what the test will do and what might be uncovered.
• Fourth, students are free to attack our product as per the presented plan

Before testing begins, students should present a testing plan to us. This should include tools they will use, techniques for exploration, what categorical vectors of attack will they go after, and any other information they feel like they need to present. This should be presented to us via a small slide deck or other means.

After testing is complete, the final deliverable should be a written report detailing how the test was conducted, what tests passed, what tests failed, recommendations for mitigation strategies, and any further notes from the testers. Other items to consider for a final report should be:

• An executive summary detailing overview, timeline, key findings
• Categorizing all findings into vulnerability levels such as critical, high, medium, low
• High detailed summaries of any findings
• Low detailed summaries of any tests conducted with no findings
• A recap of any tools used

Final Deliverables:

Provide details about what the student will upload to the platform as their final deliverable(s).

Review our status of threat response and resilience to cyberattacks.

Recommend and/or set up monitoring and alerting tools to monitor security status/incidents.

Set up tools to observe our ICT solutions' health and performance status: databases, client and backend apps, downtimes, network latencies and response times, app logs/errors, data synchronization.

Optimize data synchronization logic between distributed HW devices and our cloud database.

Benchmark and harden our tools' configurations: operating systems, networking, servers.

Review and set up disaster recovery strategies.

Review and document automated CI/CD pipelines (deployment flow).

Benchmark our adherence/readiness to HIPAA or GDPR regulations.

Review and recommend improvements on our QA process and test cases.

For students: To validate the completion of your work, please submit deliverables as uploaded files with a reflection note at the end of your project. These files can take various formats, including Word documents, PDFs, JPEG images, presentations, and more. We request tangible proof or an example showcasing your completed work. If the project involved an Non-Disclosure Agreement (NDA), please provide redacted deliverables or a sample of non-confidential work.

A walk through of the product, as well as lighter technical details of it will be provided to students before they begin testing.

Common vulnerability knowledge such as exploration into OWASP Top 10 and common testing tools will be provided to students as a starting point.

Students will be able to ask questions at any point during the process.