Romashka Website Security Report: Semester 2, 2024

Desklib provides solved assignments and past papers to help students succeed.

WEB SECURITY OF ROMASHKA

Abstract
Romashka is a web-based application which is fully functional and ready to fulfill the
requirements of Russian Language school which is being located at 6 Lawson Street,
Southport, Queensland. Web Application will have multiple functionalities like Sign up and
Login of Students and Staff member of Russian School, and dashboard is being built for
maintaining and uploading new course work for their school and to manage them
accordingly. Security of Web application is another main constraint which should be taken
care of building the website. The website should follow a good set of secured option which
will be provided to the students and staffs of school as well. This study will be based on
implementing different approaches to cybersecurity and where it should be implemented in
Romashka. The password which is being entered by the user will be stored in a form of a
hash map in a database which will provide extra security of the database, in case database is
being accessed by an unauthenticated user it will not be able to retrieve the password of users
available in the database.
While purchasing a course, it should be recommended that 128- bit encryption will be used
for securing the credit and debit card details of the user. An authorized Payment Gateway
should be used in this project which will make it more promising for the user to purchase the
products from the website using that Gateway.

Table of Contents
Abstract................................................................................................................................................2
Introduction.........................................................................................................................................4
Cyber Security in Romashka..............................................................................................................5
Introduction.....................................................................................................................................5
Research Background.....................................................................................................................5
Web Security Secured Website from.............................................................................................5
Importance of Web Security...........................................................................................................6
Measures to be taken to improve the security of the website.......................................................7
Case Study: Implementation..............................................................................................................7
Website security...............................................................................................................................9
Database security...........................................................................................................................10
Payment gateway security.............................................................................................................10
Conclusion..........................................................................................................................................12
References...........................................................................................................................................13

Introduction
Romashka website is being built for Russian School, which offers different coursework for
the student. This website will provide an interface for the students in which they have a
variety of courses available as an option to choose them in their semester and Staff/ Teachers
of school have authority to upload an assignment in the dashboard of Romashka. The
dashboard will have multiple functionalities like assignment uploading and submission,
Grade calculator and have a discussion forum which will be helpful asking a doubt in mind of
the student. Admin panel has the authority to add and remove any staff member who was
working in a school. Coursework can be added by Admin Panel. For enrolling in a course, the
student should have to pay a fee of the particular coursework which is being authenticated by
a payment gateway which includes online transactions such as master/ visa card or payment
through net banking. (Adiwijaya et al., 2016)
Security will be the main constraint after the development of the web application. Various
online scams and frauds occurred through the digital world and to avoid such a mess, a better
solution should be searched and implemented in Romashka. Security means online
transactions occurred over a website will have an authenticated support and database which
will store the records of students and staff should be secured. This Research study will be
based on finding more prominent security options which will be included in the website and
implemented on the website.

Cyber Security in Romashka
Introduction
Cyber Security or Web security will have a critical component on a website. Cyber-attacks
will cause damage to the reputation of the website, and discourage regular visitors on the
website. Website Security is defined as preventing prestigious data available on the website
and to secure this data from criminals of the cyber world and to prevent any exploitations in
the website (Essa et al., 2018). Cyber Security should be considered as a major constraint and
it should be implemented on each website which was running on the internet. Security will be
the main constraint after the development of the web application. Various online scams and
frauds occurred through the digital world and to avoid such a mess, a better solution should
be searched and implemented in Romashka. Security means online transactions occurred over
a website will have an authenticated support and database which will store the records of
students and staff should be secured (Ikram et al., 2016).
Research Background
Maintaining website security is as important as building an effective website with a good and
attractive interface. There are some certain constraints which suggest the importance of
website security. They were mentioned below.
Web Security Secured Website from
Malware: Very Common Threat which is being used for stealing the sensitive content of web
application which can be prestigious data of customer which were using the website
regularly. This threat can provide access to cybercriminals (Sheleheda et al., 2015).
Blacklisting: This will remove the website from the search engine and warns the customer to
stay away from the website if any malware is being detected by the search engine.
Defacement: Content of the website will be replaced by the malicious content of the hacker.
The exploitation of Vulnerabilities: Weak areas of the website will be breached by
attackers and data of the customers can be retrieved by the attacker.
DDoS Attacks: This attack will slow down the site and will crash the site which makes the
website inaccessible to visitors.

SQL Injection: By using this method attacker will access the database of the website which
would contain some prestigious data in it. The data can be password or either it could be card
details of the visitor which visits the website (Ali, 2016).
Cross Site Scripting: XSS can be a vulnerability, by using this attacker will have granted
with an access of injecting a script in a webpage. With the help of SQL Injection,
unauthorized access will be granted to the attacker, by using this it can delete, create or
modify some of the essential information which was present in website (Felt, 2016).
Website Romashka is being developed for Russian Language school. This website will
provide an interface for the students in which they have a variety of courses available as an
option to choose them in their semester and Staff/ Teachers of school have authority to
upload an assignment in the dashboard of Romashka. The dashboard will have multiple
functionalities like assignment uploading and submission, Grade calculator and have a
discussion forum which will be helpful asking a doubt in mind of the student. To meet the
requirements of well-defined website security would be implemented over the website. In
Romashka, the student will have access to buying the course online which will help them to
enroll in a new course with just one click. Online Payment should be secured because it
contains some sensitive data of the customer, and fault gateway leads to loss of some crucial
credentials of students which can be accessed by the attacker (James, 2016).
Storing data of students and staffs should also be secured because important data can be lost
if it is not stored in the right format. Database security should be achieved using some
encryption techniques which should be used by the database designer and design the database
keeping security constraint in mind. Romashka is being used by all the students and staff in
the school. For such a large amount of users maintaining their security will be an important
factor. In the database, the password should be stored in a hash form which will provide more
security of the database.
Importance of Web Security
Website is being built to exhibit some important information about any business or brand
which will be using the website. Website will be considered as the first interaction with the
customer. For maintaining the visitors of the website, it should be mandatory for the website
that it will be secured as well as interactive and attractive in design as well. By a single
security breach, the whole business can be collapsed and it will lead to failure of the business
which was just being established. Various laws are being defined for preventing the security

breach and many laws have some fines as well. But beaching of security will cause a high
impact on the trust of the customers who were using this website for a long time.
Measures to be taken to improve the security of the website
 This would be a difficult choice because the security of the website will depend upon
various factors and by improving one factor it would not majorly affect the other
security vulnerability which is being present in the website. All devices and computer
should be free from the malware so that it would not affect the security of the website.
Various services are being offered by the third-party website which should be
installed on the computer to remove the computer and devices from the malware.
 Hosting of the website would be an important factor in website security, hosting of
the website will be dependent upon the infrastructure of the website in which the
website should be developed. This can be compared with the example of building a
house, For constructing a house foundation of the house should be strong so that it
will provide safety to the persons who will live in that house. After choosing the host
of the website, the development of the website will also be an important constraint.
For Example, if someone left the door open of their home, it should be the
responsibility of the owner of the house not the builder of the house. This will be the
same scenario going between the owner of the website and the hosting provider of the
website.
 Proactive Nature of the website or business owner will take care of the security of the
website. There were many owners of the website which does not provide any attention
towards the security of the website and this will cause a huge impact on their business
or website. The decrease in the number of visitor on the website will cause failure in
the business of website owner. So, proactive nature will help to improve the security
of the website.
Case Study: Implementation
Websites are very much at risk as they are highly prone to attacks and breaches of security.
As cybercrimes are increasing day by day websites are required to be protected by the
security measures. Web security is basically a protection measure that is capable of protecting
the website from hacking.
Characteristic of the good plan of web security are:

 Malware scan and removal
 File change monitoring
 Blacklist removal
 Manual malware removal
 Spam monitoring
 Site deal
 Security monitoring
 Content delivery network
 Firewall
 Advanced DDoS mitigation
Technologies that used for securing the website are:
 Tools of black box testing
 Fuzzing
 Password cracking
 Web application firewalls
 Tools of white box testing
 Vulnerability scanner

Website security
To make the website more secure, firewalls can be implemented that helps in the security of a
web application by monitoring and filtering of the HTTP traffic between the internet and an
application. It simply secures an application from the attacks of cross-site scripting, SQL
injection, cross-site forgery, and file inclusion. It is a protocol that defends layer 7 and is not
capable of defending all types of attacks. When the layer of the firewall is applied in between
the internet and the application, a shield is made between them (Urbanovič et al., 2016).
The strategies that can be implemented to secure the website are:
 Keeping software updated is essential:
For the patching of the security holes, software or platforms installed must be updated
from time to time because attackers commonly target on the flaws of security.
 Login pages should be encrypted:
Login pages should be encrypted by the use of SSL encryption. It allows secure
transmission of the login credentials, social security numbers, and credit card numbers. It
should be encrypted in such a way that it should be meaningless to others. The secure host
must be used:
Website security somewhat depends on the type of host. The host should be trustworthy,
secure and reputable. The host should be able to back up the data to a server that can be
accessed remotely and also make the restoring easy.
 Backup of data:
Backup of data should be maintained so that if in the case data is inaccessible or the data is
lost, data can be restored.
 The website should be scanned for vulnerabilities:
Scans for the vulnerabilities and malware should be performed at regular basis and also
after any update or change in the website. For doing this, plenty of free tools can be used
which are available on the internet. These scanners are only capable of giving an overview
but are not helping in detecting all the laws regarding security.
The use of WAFP can be done in order to achieve high security. It is a web application
fingerprint tool which is written in Ruby with the use of SQLite3 DB. It only allows those
files to be fetched that are given by the prints of the finger. After the fingerprints, the
checksum is checked if the checksum of the file is matching with the finger print's checksum
(Manhas et al., 2015).

Database security
The security of the database is also a very important aspect and creating a secure database is
highly recommendable. Database security is the procedure, system or process that is used to
secure the database from malicious attacks and authenticated misuse that can be made by the
authorized person. For doing so, connections like firewalls and routers are set-up. To secure
the database one should involve strategies like:
 Access control to the database:
Limit the permission of the database and grant permission to only those users who are
really in need to access the database with proper credentials.
 Identifying which data is sensitive and which is critical:
Identifying significant information for protection is the very first task. Therefore, it is
necessary to have proper knowledge of the architecture and logic of the database to
determine how the data will be secured and at what place.
 Encrypt information:
The database contains lots of significant information, therefore, the attacker or the
hijackers will first seek into the database. Hence, make the database secure by not allowing
an unauthorized person to access the database (Pandrangi et al., 2015).
 Keep monitoring the activity of the database:
Keep a regular eye on the logging and the administrator. From the complete history,
leaking of information can be avoided.
 Use firewalls:
The use of firewalls can help to secure the database from the vulnerable attacks. It can help
in keeping critical information away from the hijackers or the attackers (Osanaiye et al.,
2016).
Payment gateway security
Making secure payment gateways is an essential step to avoid fraud and scam as a secure
gateway of payment only allows authenticated and authorized users to make the payment
with the right credentials. This is an important aspect to gain the customer's trust. To make
the gateway secure, the following strategies can be taken into account.
 Make use of secure connections:
A secure connection is a connection that hides the activities from the authorized persons. It
is basically an encrypted internet connection (SSL). https defines that the connection is

secure whereas HTTP says that the connection is not secured. Hence, to make the gateway
of payments more secure make use of the https connection.
 Monitor all the transactions:
All the transactions must be monitored in order to have proper security. The gateway
should have the capability to track the unusual transactions made by the user.
 Make use of secure passwords:
Make the passwords and important credentials more secure by incorporating the
mechanism of encryption. Get a link with the banks to avoid scam as the banks create a
one-time password (OTP) and send it to the mobile number which is linked to your bank's
account. The gateway will allow the payment to continue only if the one-time password
entered matches with the password generated by the bank; otherwise, the payment will be
denied by the bank.
 Leave with no evidence:
If by chance, one has handed over the details of the payment like card number, validity
date, CVV, and most important the OTP by the means of emails or text than, it should be
deleted as early as possible and remind your partner to delete as well to avoid leaking of
the information (Mîlcomete et al., 2015)

Conclusion
This study will be based on implementing different approaches to cybersecurity and where it
should be implemented in Romashka. The password which is being entered by the user will
be stored in a form of a hash map in a database which will provide extra security of the
database, in case database is being accessed by an unauthenticated user it will not be able to
retrieve the password of users available in the database. While purchasing a course, it should
be recommended that 128- bit encryption will be used for securing the credit and debit card
details of the user. An authorized Payment Gateway should be used in this project which will
make it more promising for the user to purchase the products from the website using that
Gateway.
From the above case study, it was concluded that securing the web application from being
attacked by the attackers and hijackers is very important. Hence, to make the secure web
application firewalls are induced in the application. WAFP (web application fingerprint tool)
is made into use which finds the matching checksum of the file to that of the finger print's
checksum. The database has also been made secured by limiting the permission of access to
the database and allowing only the authenticated and authorized a person to access. An
encryption mechanism must be incorporated into the database in order to stop the leakage of
the information. Regular monitoring on the activities has to be performed to analyze and to
determine the unusual access. The use of firewalls is also made in use. The security level is
increased at the payment gateways in order to have the secure payment and spam can be
reduced. Payments are linked with the bank account so that only the authenticated person can
make the payments. Passwords are secured using an encryption mechanism to reduce the
feature of readability so that it could not be known by the spam or fraud persons.