Scoops2GO Secure Development Cycle

This report overviews Scoops2GO current prototype V0.1 and full product V0.1. The aim of Scoops2GO is to build a robust software development cycle. However, they moved from a current prototype after exploring digital space in 2020. The organization aim to offer digital service like its competitors known as Deliveroo and Just Eats. This report advises Scoops2Go on the best software development security by highlighting the threat models. The threat model offers a comprehensive overview oof the security threats and vulnerabilities identified for the current prototype and full product. The identified threats for the current prototype include data leaks, malicious injection, and unauthenticated access control. These identified threats also have their mitigation strategies highlighted, which offer a robust solution to the threats and vulnerabilities. The mitigation strategy for the current prototype includes input validation, parameterized queries, comprehensive access control assessment evaluation, authentication mechanism, role-based access control (RBAC), and access control in API. The report also gives a comprehensive understanding of the threat model for the full product. The identified threats are highlighted and have mitigation strategies employed to address the threats and vulnerabilities. This identified threat for the full product includes Broken object level authorization and cross-site scripting. The mitigation strategies employed include authorization mechanism, random unique identifier, rate limiting and API gateways, input validation, secure cookies, and web application firewall. The report also addresses the security code review presented. Based on the security code review various critical issues were discovered, which need to be addressed to prevent threats and vulnerability from occurring in the software code. In addition, the report also highlights robust secure software development practices and tools to be implemented by Scoops2GO. This ensures that Scoops2GO software development cycle is secure and free from any threats and vulnerability while the tools recommended also ensures that vulnerabilities and threats in Scoops2GO application or system are regularly analyzed and monitored.