Team project, Monash University (FIT5120)
BeyondReAim
A web platform that helps young Australian workers and recent graduates see how AI may change their industry. Users pick an industry, take a guided self-assessment and get a personal risk profile. My part was the team's security, testing and ICT support.
Security findings and fixes
- Found security bugs, including a CORS misconfiguration, and worked with the developers to diagnose, fix and retest each one.
- Found that the app connected to the database with admin access. I worked with the team's database member to move it to least-privilege access.
- Added rate limiting to the app.
- Ran Nuclei scans and set up SonarQube.
Testing and review
- Tested every iteration with user, system and security testing, against the quality standards the team agreed.
- Reviewed the project for high-risk areas and gaps against the agreed standards and procedures, and reported them to the team.
ICT support
- Set up the team's laptops so each one could run the app and its tools locally, and fixed installation problems as they came up.
Documentation
- Wrote the team's security report. It covers:
- a risk assessment of the app;
- an incident response plan;
- identity and access management, with an access matrix;
- the privacy, legal and ethical issues to consider when building the app;
- real security incidents related to the tools, packages and software the app uses;
- a backup and restore plan.
- Worked with the team on the handover documents: the system specification and the setup and troubleshooting guides.
