[PROGRESS] Client Requested Changes

[LiamTownsley2]

The client has identified that it will also be required to track software being used on the company
network. Once again it must be possible to add, view, edit, or delete this asset data.
As before, a unique identifier should be automatically generated for each asset. For now, it would be
sufficient to store data about the operating system name, version, and manufacturer. The client
would like your software to get this data automatically from the system on which it is running. It
should also be possible to link hardware assets with software assets, allowing the client to
determine where software is installed. The current date should be automatically associated with the
link.

For both hardware and software assets, it would be useful if errors in data could be prevented, or
identified and corrected, at the point of entry. Because of security concerns access to the system
must be controlled and any user must be authenticated with an email address and password. Pre-
configured credentials may be used but must be stored securely. Reasonable precautions should be
implemented to ensure the system functions reliably and securely.

The client envisions that asset data will assist in identifying vulnerable assets, which will allow the
information technology department to act. Because it is difficult for the client to track when assets
become vulnerable to new exploits, the system must provide a feature to search for vulnerabilities
to assets in an online database. The security consultant has advised that the NIST National
Vulnerability Database (NVD)1 would be suitable for this purpose. The system should allow checking
a software asset (i.e., operating system) version against the NVD and listing relevant information if a
high or critical severity vulnerability is found.

Software Assets

• Implement Typings for Software Assets, a Software asset should consist of a Unique ID, Operating System Name, Version and Manufacturer. #30
• Implement support for two types of assets Software and hardware assets in the database. #31
• The data from the system on which it is running should be automatically added to the database. #32
• It must be possible to link Hardware & Software assets together and the current date should be associated with this link. #33

Error Checking

• Ensure that incorrect data cannot be entered into the database. #34

Adding Employee Login

• Create a login page #35
• Create a page to create employee #36
• Render the login page by default & disallow nagivation to other pages unless logged in. #37
• Implement support for registering a user #38
• Encrypt user password & save username & password into database. #39
• Implement support for logging in as a user #40
• Ensure that encryption is used throughout the entire process #41

NIST Vulnerability Database
The client also wants to link the project in with the NIST NVD.

• Implement a "Scan Software" button on software assets. #42
• Input this data into NVD database. #43
• Filter results and only display high / critical vulnerabilities. #44
• Display NIST result to user. #45