Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
64 changes: 47 additions & 17 deletions # Password Guideline.md
Original file line number Diff line number Diff line change
@@ -1,44 +1,69 @@
# Password Guideline

Our ‘Thoth Tech’ organisational security policy is the document that defines the scope of a utility’s cybersecurity efforts. It serves as a repository for decisions and information generated by other building blocks and a guide for future cybersecurity decisions. The policy includes proposed solutions, scopes, goals, responsibilities, security program structure, compliance, and the approach to risk management.
Our ‘Thoth Tech’ organisational security policy is the document that defines the scope of a
utility’s cybersecurity efforts. It serves as a repository for decisions and information generated
by other building blocks and a guide for future cybersecurity decisions. The policy includes
proposed solutions, scopes, goals, responsibilities, security program structure, compliance, and the
approach to risk management.

## Background Information

Hackers are born as bright as developers and programmers nowadays. Cybersecurity problems are faced by individuals or groups connected to the internet in a day-to-day working environment.
According to a study by the University of Maryland, “hackers attack computers connected to the Internet every 39 seconds. Thus, online computers attacked on average 2,244 times a day. The Worldwide Information Security Market is forecast to reach 170.4 billion in 2022 (Gartner). It is now not a question of “If” an attack will happen but when.” – (Cukier, Michel. May 2020).
In this ever-evolving threat landscape, it is imperative for every organisation to have documented Security Policies to mitigate the risks.
As mentioned by Chaudary, “Cybersecurity plays a crucial role within the field of the digital world. Securing information and data has become one of the most critical challenges in the present day. Whenever we expect cybersecurity, the primary thing that involves our mind is cybercrimes increasing immensely daily. Various Governments and Organizations are taking many measures to stop these cybercrimes”. (Chaudary, Varsha, Feb. 2022)
Besides various measures, cybersecurity remains a massive concern to several. The top three cybersecurity trends in 2021 are:
Hackers are born as bright as developers and programmers nowadays. Cybersecurity problems are faced
by individuals or groups connected to the internet in a day-to-day working environment. According to
a study by the University of Maryland, “hackers attack computers connected to the Internet every 39
seconds. Thus, online computers attacked on average 2,244 times a day. The Worldwide Information
Security Market is forecast to reach 170.4 billion in 2022 (Gartner). It is now not a question of
“If” an attack will happen but when.” – (Cukier, Michel. May 2020). In this ever-evolving threat
landscape, it is imperative for every organisation to have documented Security Policies to mitigate
the risks. As mentioned by Chaudary, “Cybersecurity plays a crucial role within the field of the
digital world. Securing information and data has become one of the most critical challenges in the
present day. Whenever we expect cybersecurity, the primary thing that involves our mind is
cybercrimes increasing immensely daily. Various Governments and Organizations are taking many
measures to stop these cybercrimes”. (Chaudary, Varsha, Feb. 2022) Besides various measures,
cybersecurity remains a massive concern to several. The top three cybersecurity trends in 2021 are:

- Ransomware
- Cyber-attack Surface (IoT supply chain and Remote work systems)
- Threats to IT infrastructure

## Password Policy

Furthermore, I quote the work of Chaudhary about networks or any internet-related password policy. “A crucial component of computer security is passwords. They are the user accounts' first line of defence. The concept of usernames and passwords has been a fundamental way of protecting our information. The purpose of this policy is to determine the creation of strong passwords, the protection of these passwords, and, therefore, the frequency of password change must be followed.” (Chaudary, Varsha, Feb. 2022)
Furthermore, I quote the work of Chaudhary about networks or any internet-related password policy.
“A crucial component of computer security is passwords. They are the user accounts' first line of
defence. The concept of usernames and passwords has been a fundamental way of protecting our
information. The purpose of this policy is to determine the creation of strong passwords, the
protection of these passwords, and, therefore, the frequency of password change must be followed.”
(Chaudary, Varsha, Feb. 2022)

### Purpose:

This policy aims to provide a standard for developing secure passwords, their protection, and how frequently they should be changed.
This policy aims to provide a standard for developing secure passwords, their protection, and how
frequently they should be changed.

It is necessary to make sure each person is whom they claim to be (authentication), usually by checking the user ID and password they enter and allowing them to access only the data they’re allowed to use (authorisation).
It is necessary to make sure each person is whom they claim to be (authentication), usually by
checking the user ID and password they enter and allowing them to access only the data they’re
allowed to use (authorisation).

Thoth Tech requires passwords to include a variety of symbols. It should have at least one number, both uppercase and lowercase letters, and one or more special characters.
Thoth Tech requires passwords to include a variety of symbols. It should have at least one number,
both uppercase and lowercase letters, and one or more special characters.

1. It should not contain your personal information — specifically, your real name, username, student ID, etc.
2. Reset local admin passwords every 180 days. This can be done with the free Netwrix Bulk Password Reset tool.
1. It should not contain your personal information — specifically, your real name, username, student
ID, etc.
2. Reset local admin passwords every 180 days. This can be done with the free Netwrix Bulk Password
Reset tool.
3. Passwords cannot be used from the previous five passwords.
4. All online and desktop accounts must change at least every six months.
5. The password should be changed in the case of a potential threat or suspected unauthorised access.
5. The password should be changed in the case of a potential threat or suspected unauthorised
access.

The following passwords are discouraged:

- Easy-to-guess passwords, especially the phrase "password."
- A string of numbers or letters like “1234” or “abcd.”
- A series of characters appear sequentially on the keyboard, like “@#$%^&.”
- A user’s given name, the name of a spouse or partner, or other names
- The user’s phone number or license plate number, anybody’s birth date, or additional information easily obtained about a user (e.g., address or alma mater)
- The user’s phone number or license plate number, anybody’s birth date, or additional information
easily obtained about a user (e.g., address or alma mater)
- The same character typed multiple times, like “zzzzzz.”
- Words that can be found in a dictionary
- Default or suggested passwords, even if they seem strong
Expand All @@ -47,10 +72,15 @@ The following passwords are discouraged:

## Account Management Policy:

This policy aims to establish a precise procedure for setting up, managing, and deleting accounts that permit access to Thoth Tech's information. In Thoth Tech, we use Miro, Trello, Microsoft Teams, Docker hub, lucid chart etc. The top system administrator, like the leaders, has control and management roles in creating, editing, and maintaining group access. Credentials dedicated to users' access are identified, and data security bridging is controlled.
This policy aims to establish a precise procedure for setting up, managing, and deleting accounts
that permit access to Thoth Tech's information. In Thoth Tech, we use Miro, Trello, Microsoft Teams,
Docker hub, lucid chart etc. The top system administrator, like the leaders, has control and
management roles in creating, editing, and maintaining group access. Credentials dedicated to users'
access are identified, and data security bridging is controlled.

## References:

1. Cukier, Michel. “Hackers Attack Every 39 Seconds.” Security Magazine RSS, Security Magazine, 24 May 2020, https://www.securitymagazine.com/articles/ 87787-hackers-attack-every-39-seconds.
1. Cukier, Michel. “Hackers Attack Every 39 Seconds.” Security Magazine RSS, Security Magazine, 24
May 2020, https://www.securitymagazine.com/articles/ 87787-hackers-attack-every-39-seconds.
2. Chaudhary, Varsha, “Cyber Security Policy” 22 Feb. 2022, Cyber Security Policy - GeeksforGeeks
3. https://www.quest.com/solutions/active-directory/what-is-active-directory.aspx
3. https://www.quest.com/solutions/active-directory/what-is-active-directory.aspx
2 changes: 2 additions & 0 deletions .gitattributes
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
# Set the default behavior, in case people don't have core.autocrlf set.
* text=auto eol=lf
36 changes: 24 additions & 12 deletions docs/OnTrack/UI Enhancement/Component Reviews/grade-icon.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
# Ontrack Component review

## Team Member Name

Shounak Bhalerao | S224743249

## Component Name
Expand All @@ -11,51 +12,62 @@ Shounak Bhalerao | S224743249

## Component purpose

The purpose of `grade-icon` is to provide a unified simple component, for displaying the grade student is expecting.
This item, can only be seen on screens with Tutor or higher permissions.
The purpose of `grade-icon` is to provide a unified simple component, for displaying the grade
student is expecting. This item, can only be seen on screens with Tutor or higher permissions.

## Component outcomes and interactions
Users can hover over this icon to get what grade student is targeting.
It's a Visual component with no interactivity or subcomponents.

Users can hover over this icon to get what grade student is targeting. It's a Visual component with
no interactivity or subcomponents.

## Interaction with other components

### Input

Any Component which wants to invoke this components need the following inputs

```typescript
@Input grade: string; // project.targetGrade
```

### Current Usages
I noticed that this component was used in `student-list` model.
In order to view this model we need to log in using the following credentials.

I noticed that this component was used in `student-list` model. In order to view this model we need
to log in using the following credentials.

> username: atutor

> password: password

![grade-icon-usage](Resources/grade-icon-usage.png)

## Component Migration Plan
will be following doubtfire-web's Migration Guide and refer to existing components already migrated to TypeScript to ensure my code follows the same code style & conventions.
I will be using the following as reference: [comments-modal](comments-modal.md)

will be following doubtfire-web's Migration Guide and refer to existing components already migrated
to TypeScript to ensure my code follows the same code style & conventions. I will be using the
following as reference: [comments-modal](comments-modal.md)

### Original (Image):

![grade-icon](Resources/grade-icon.png)

### Post-Migration (Image)

![migrated-grade-icon](Resources/migrated-grade-icon.png)

### Original (Hover)

![grade-icon-hover](Resources/grade-icon-hover.png)

### Post-Migration (Hover)

![migrated-grade-icon-hover](Resources/migrated-grade-icon-hover.png)

> Note:
> There is a small change in the way the hover block looks
> since previously we were using Bootstrap, and now we shifted to
> Angular Material.
> Note: There is a small change in the way the hover block looks since previously we were using
> Bootstrap, and now we shifted to Angular Material.

## Referenes

- Doubtfire-web Pull Request: https://github.com/thoth-tech/doubtfire-web/pull/258

## Status of operations: PR in REVIEW
28 changes: 21 additions & 7 deletions docs/OnTrack/UI Enhancement/Component Reviews/group-member-list.md
Original file line number Diff line number Diff line change
@@ -1,73 +1,87 @@
# OnTrack Component Review

## Team Member Name

[Fuk Sang Wong] | [224078886]

---

## Component Name

- `group-member-list.component.ts`
- `group-member-list.component.html`
- `group-member-list.component.scss`

---

## Component Purpose

The purpose of `group-member-list` is to display members within a selected group. It supports:

- Sorting members by specific attributes like name, grade, or ID.
- Dynamically updating the list of members when one is removed.
- Displaying appropriate messaging for empty groups or unauthorized actions.
- Displaying appropriate messaging for empty groups or unauthorised actions.

---

## Component Outcomes and Interactions

Users can:

- View the list of group members.
- Sort members by various columns (e.g., name, ID).
- Remove members dynamically (if authorized).
- Remove members dynamically (if authorised).
- See a loading spinner during data fetching.

Inputs used in the component:

```typescript
@Input() group: Group; // The group object containing the list of members
@Input() allowRemove: boolean; // Determines if users can remove members
```

Outputs emitted by the component:

```typescript
@Output() memberRemoved: EventEmitter<Member>; // Event triggered when a member is removed
```

---

## Component Migration Plan
I will be following the [Thoth-Tech Migration Guide](https://github.com/thoth-tech/doubtfire-web/blob/main/MIGRATION-GUIDE.md)

I will be following the
[Thoth-Tech Migration Guide](https://github.com/thoth-tech/doubtfire-web/blob/main/MIGRATION-GUIDE.md)
and referring to other migrated components to ensure consistency with the project.

Steps to be completed:

1. Refactor CoffeeScript logic to TypeScript using Angular 17.
2. Rewrite the HTML template using Angular 17's syntax and Tailwind CSS for styling.
3. Migrate and modularize the SCSS styling into reusable Tailwind CSS classes.

Visual references:

- Original Design (Before Migration):
- ![group-member-list-original](Resources/group-member-list-original.jpg)
- ![group-member-list-original1](Resources/group-member-list-original1.jpg)
- Migrated Design (After Migration):
- *Placeholder: To be added after migration is completed.*
- _Placeholder: To be added after migration is completed._

---

## Component Post-Migration
*This section will be updated after the migration is completed.*

_This section will be updated after the migration is completed._

Expected outcomes after migration:

- The component will be refactored to align with Angular's best practices.
- Accessibility improvements:
- Keyboard navigation support.
- Screen reader-friendly attributes (e.g., `aria` tags).
- Enhanced error handling:
- User-friendly messages for server errors or unauthorized access.
- User-friendly messages for server errors or unauthorised access.
- Validated UI responsiveness for different screen sizes.

---
---
Loading