Security Issues

Sensitive Information

Our software will use the following sensitive information:

• Blackboard student ID
• Preferred name
• Personal and University emails
• Phone number

Since our login process is done largely through the blackboard API, we will not be storing password information, and as such passwords should be kept safe by default. In order to keep the login process secure, we will ensure an HTTPS connection, sanitize any user input, and store any necessary information as a salted hash rather than cleartext, if there is any.

Potential Attacks

At any point in our application where user input is allowed, particularly where data will be sent in to our SQL database, there will be a risk that users could utilize SQL injection or some other cross-site scripting (XSS) attack to insert their own code and perform malicious acts like reading user data, manipulating data, or dropping tables entirely.

In order to prevent this, we will sanitize all user input, potentially using jsoup’s clean functionality as well as PreparedStatements and encrypt all sensitive information at the database level using PostgreSQL’s encryption methods. We will also create a token specifically for the app to use on the database that will have the bare minimum permissions for functionality. All of our SQL statements will be prewritten, again using prepared statements to limit the ability of users to create their own statements.

Our protection plan will include enforcing HTTPS, using OAuth tokens for Blackboard, using Angular's DomSanitizer to clean outputs, using pgcrypto on sensitive fields in PostgreSQL, and adding CAPTCHA checks to our logins to prevent brute force attacks. In the event of a leak, we will figure out the extent of the leak, notify Blackboard, and lock down our application until we solve the problem.