CS-2021 SBT - Security Benchmarking Tool

FAF 192 Y3-S1

Pasecinic Nichita

Tech Stack

• Electron - for building cross-platform desktop apps (the app is configured to run in browser too)
• React with TS - for UI (antd components)
• Express - for our NodeJS api (multer for file storage, crypto used for encryption / decryption)
• PassportJS - for OAuth authentication (providers Google, GitHub, Twitter)
• MongoDB - application database (mongoose odm)
• Nodemailer - sending emails (email confirmation)

---

Topics

• 1 - Importing Compliance Audit Policies
• 2 - Creating Custom Audit Policies
• 3 - Auditing a Workstation
• 4 - Enforcing a Policy
• 5 - Enforcing a Policy (cont'd)
• 6 - SSO Security
• 7 - Database Security
• 8 - Email Confirmation

---

Get Started

$ # clone the project
$ git clone https://github.com/nichitaa/CS-Labs
$
$ # install dependencies (electron deps)
$ cd app\electron-ts 
$ npm install # or yarn install
$
$ # install dependencies (express api)
$ cd app\express-api
$ npm install 
$
$ # run the app (api should start first)
$ cd app\express-api
$ npm run dev # available on http://localhost:8080
$
$ # run the desktop app
$ cd app\electron-ts
$ npm run dev # will open desktop app
$ # but the app could be open in browser too on: http://loclahost:3000

---

Environment variables

The API requires several environment variables to be configured in order to run locally on your machine. Please create the .env file in the root of the express API (folder: \app\express-api ) with your specific configurations

MONGODB_URL= # mongo db connection url

GOOGLE_CLIENT_ID= # google client id
GOOGLE_CLIENT_SECRET= # google client secret

GITHUB_CLIENT_ID= # github client id
GITHUB_CLIENT_SECRET= # github client secret 

TWITTER_CONSUMER_KEY= # twitter api key
TWITTER_CONSUMER_SECRET= # twitter secret key

SMTP_HOST = # e.g. smtp.gmail.com
SMTP_PORT = # defaults to 587
SMTP_FROM_NAME = # emails will be send with this name
SMTP_AUTH_USER = # email will be send from this email address
SMTP_AUTH_PASS = # nodemailer.createTransport password for email provider

---

Demos

1 - Importing Compliance Audit Policies

• Importing an audit file
• Parsing it to a JSON structure and saving it as a mongodb document
• Saving the document on the local server (uploads folder)

2 - Creating Custom Audit Policies

• Displaying each policy item in a separate section
• Select / deselect a custom policy item from an audit document
• Search bar for quick search an audit custom item by attribute value
• Select / deselect all custom items in one click
• Create and save and display in the app a new policy with selected custom items under a new name

3 - Auditing a Workstation

• Perform an audit of the workstation, using the selected custom items
• Display the scan results as icons, where green checkbox is a passed test, red - failed, yellow is warning this means that the values from expected are not the same but still is valid the optional "CAN_NOT_BE_NULL" || "CAN_BE_NULL"

4 - Enforcing a Policy

• As a backup system, the application will export all current system registry key : HKLM, HKCU, HKCR, HKU and HKCC to a folder on desktop (ex: regedit-backup1632761699)
• Apply a single fix (enforce), on a single failed custom item
• Apply a batch fix over all failed items
• Live results

5 - Enforcing a Policy (cont'd)

• Adding more custom items rule types that can be enforced by the system

6 - SSO Security

• Adding user authentication with SSO
• PassportJS (SSO providers are Google, GitHub and Twitter)
• The raw data from passportjs is displayed on the UI as a JSON structure

7 - Database Security

• Some of the fields (e.g. audit filename) is saved as an encrypted value in database (aes-256-ctr algorithm)

• The email confirmation token used for user email verification is encrypted as well

• "token": {
  	"iv": "7b54d294024a965daed91065f86b83f0",
  	"content": "c84a154d23bf78a6ccc61127c44beb1626880e7c"
  }

8 - Email Confirmation

• Registered users have the possibility to verify their email address (extracted from SSO providers)
• The verification tokens are encrypted and stored together with a user mapping in a mongodb collection
• Nodemailer is used for sending email via our express api
• Token confirmation page is server side rendered
• The electron SBT app will display the current status of the user email verification

Download full app demo ?