nc3-lu/fit4cybersecurity

A self-assessment tool by @NC3-LU to help business owners implement a better cybersecurity strategy.

Fit4Cybersecurity

Fit4Cybersecurity is a self-assessment tool by NC3-LU to help business owners implement a better cybersecurity strategy.

Installation

Instructions available in the documentation.

Contributing

Please read the CONTRIBUTING instructions.

License

This software is licensed under GNU Affero General Public License version 3

Copyright (C) 2019-2023 Luxembourg House of Cybersecurity

fit4cybersecurity's Issues

Add a general tool feedback form

Can be a popup window on results page or a separate page.
Use the same table to store the data without linking to a particular question.

Temporary preview of answered questions + link to continue

Adding Companies

Add a list of companies which can helpful with particular recommendations

Prevent to have many times the same recommendations

Before editing all the recommendations, it can be usefull to check if a recommendation is not twice

For exemple : Answer A bring recommendation 1 & 2
Answer B bring recommendation 2 & 3

The recommendation 2 will appear twice

Possibility to compare one assessment with a few others in the past using the same questions

Implement variable max scores and and points per answer

Depending on the answers on questions the max points per question and answers scores may be different.
The goal is to implement separate tables with many to many relations, to define the scores dependencies and use them in the calculation when they are set.

List of the impacted parts/dev:

• Extract maxPoints to a separate table
• The same approach for answers' scores - a separate table.
• Import the data via json files
• Support backward compatibility - when the scores/points are not defined, go with the default points/scores use.
• validate the new functionality doesn't impact the other sites.

Accesiblity to any page for debugging in beta version

If we want to access a page and see how JSON data are displayed without going through all questions.
Only on the beta version to fix bugs and share with non-technical stakeholders before public release.

Feedback Box in questions form and display the on review page.

Adding Links to report

Add links to both downloadable report and online report in the recommendation part...

like: For more Information, you can go to CNPD

It will add value to the person doing the self-assessment

Translation portal Github integration broken

Trying to create an account here: https://translate.monarc.lu/accounts/register/

Gives a 404

change language at any moment in the survey

Rename and move to the top "restore results" link

We can rename the "restore results" link to "your results link".
Move it after the summary block.

Duplication of users' answers

In some specific case, which is not determined yet, we have duplication of user's answers (only cases 5 since the project launch).
We need to review the saving part to prevent the possible duplication.
As a solution we can lock user survey record for read when the request is received.
Alternativelly the score calculation can take a grouped results by user_id and answer_id, which will exclude the double score in the result.

PDF report generation

Generation of report in PDF.

Missing Translation

Q005A004 misses the German translation ; it's written in English.
This is the only case find so far after a check.

Develop a mechanism to be able to change questions, answers and scores

We need to develop the feature to be able to add, remove questions and related answers, and change scores of the answers without impacting the previous surveys' results.
One of the ideas is to create a versioning of the questions, answers and scores. and in order to get the right results version or date filter to fetch the right data.

Check texts

The texts needs corrections or updates:

Report_Fit4Cybersecurity_2019-11-04_fr.docx

Separation of the migration scripts from the files to populate the database

Actually the database is populated with one of the migration scripts. It would be better to use a JSON file or alike.

Possibility to flag recommendations as being country-specific, or sector-specific

VM generation with packer

Possibility to instantiate a new Fit4* product as a VirtualBox image with Packer.

The required inputs (images, templates, translations, etc.) must be provided to the Packer configuration

Add input HTML maxlength & minlength Attribute + placeholder

Possibility to limit the type of input when we already know the format and integrate an example as a placeholder.

Add country to the first question

We should add a country selection above sector, with luxembourg selected by default

Enhancements and errors on first test

• Answer in the report is always the same.
• Create sectors in the database
• Categories should appear in the recommendation tab part. Example :

1.	Rules/Charter
	Rules (organisational, IT or working ones) should be known and explained to everyone, at the very least orally. Rules that are too long or too heavy with technical vocabulary could become confusing.

• A percentage should be calculated instead of showing the true score on the chart, even if the categories are not worth the same points
• Encode user_id when we generate an email to contact us for a diagnostic.
• The result chart shouldn't have a target, it should never be changed. (But we can add an average per sector figure later to compare with).
• When a unique answer is clicked, other choices should become grey to warn that they can't be clicked (and if it's possible, couldn't be clickable anymore) and make button colour more grey.
• The Fit4Cybersecurity logo is always in French in the report
• Report name at download should be change (result-[lang] could become Report_Fit4Cybersecurity_[date]_[lang] for instance)
• Chart categories order are not the same in the report, which could be confusing.

Missing sector entries

The sector is missed:
EN: Public administration
FR: Administration publique
DE: Öffentliche Verwaltungen

Order the list of sectors alphabetically.

Deployment alternatives

Provide several deployment solutions

• classic deployment from the source code with a documentation;
• preconfigured environment for development purpose;
• release package (Docker, VM, etc.) for quick and easy local deployment;
• virtual machine with Packer: #28

Prevent to go over 100%

Exemple : set a question to 20 points
set 3 answers with 10 points each

It must be usefull to prevent to have 30/20. Just block to 30

Change countries selector display style

To improve the users' experience we can display most relevant countries in the beginning of the list and less relevant after a bottom line.

Installations issue(s)

Following the install path in the readme I fail on the following:

Not being a Django expert I am not sure what needs to be done. Setting STATIC_ROOT is not allowed.

(csskp-E_Z0xrL--py3.9) misp@misp-test:~/Fit4Cybersecurity$ python manage.py collectstatic

You have requested to collect static files at the destination
location as specified in your settings.

This will overwrite existing files!
Are you sure you want to do this?

Type 'yes' to continue, or 'no' to cancel: yes
Traceback (most recent call last):
  File "/home/misp/Fit4Cybersecurity/manage.py", line 21, in <module>
    main()
  File "/home/misp/Fit4Cybersecurity/manage.py", line 17, in main
    execute_from_command_line(sys.argv)
  File "/home/misp/.cache/pypoetry/virtualenvs/csskp-E_Z0xrL--py3.9/lib/python3.9/site-packages/django/core/management/__init__.py", line 419, in execute_from_command_line
    utility.execute()
  File "/home/misp/.cache/pypoetry/virtualenvs/csskp-E_Z0xrL--py3.9/lib/python3.9/site-packages/django/core/management/__init__.py", line 413, in execute
    self.fetch_command(subcommand).run_from_argv(self.argv)
  File "/home/misp/.cache/pypoetry/virtualenvs/csskp-E_Z0xrL--py3.9/lib/python3.9/site-packages/django/core/management/base.py", line 354, in run_from_argv
    self.execute(*args, **cmd_options)
  File "/home/misp/.cache/pypoetry/virtualenvs/csskp-E_Z0xrL--py3.9/lib/python3.9/site-packages/django/core/management/base.py", line 398, in execute
    output = self.handle(*args, **options)
  File "/home/misp/.cache/pypoetry/virtualenvs/csskp-E_Z0xrL--py3.9/lib/python3.9/site-packages/django/contrib/staticfiles/management/commands/collectstatic.py", line 187, in handle
    collected = self.collect()
  File "/home/misp/.cache/pypoetry/virtualenvs/csskp-E_Z0xrL--py3.9/lib/python3.9/site-packages/django/contrib/staticfiles/management/commands/collectstatic.py", line 114, in collect
    handler(path, prefixed_path, storage)
  File "/home/misp/.cache/pypoetry/virtualenvs/csskp-E_Z0xrL--py3.9/lib/python3.9/site-packages/django/contrib/staticfiles/management/commands/collectstatic.py", line 338, in copy_file
    if not self.delete_file(path, prefixed_path, source_storage):
  File "/home/misp/.cache/pypoetry/virtualenvs/csskp-E_Z0xrL--py3.9/lib/python3.9/site-packages/django/contrib/staticfiles/management/commands/collectstatic.py", line 248, in delete_file
    if self.storage.exists(prefixed_path):
  File "/home/misp/.cache/pypoetry/virtualenvs/csskp-E_Z0xrL--py3.9/lib/python3.9/site-packages/django/core/files/storage.py", line 311, in exists
    return os.path.exists(self.path(name))
  File "/home/misp/.cache/pypoetry/virtualenvs/csskp-E_Z0xrL--py3.9/lib/python3.9/site-packages/django/contrib/staticfiles/storage.py", line 38, in path
    raise ImproperlyConfigured("You're using the staticfiles app "
django.core.exceptions.ImproperlyConfigured: You're using the staticfiles app without having set the STATIC_ROOT setting to a filesystem path.

Error in report generation

Hey,

Crossed an error while trying to generate the report in the "survey/finish" page with the "Download" button.

Context:

• Windows 11
• Dockerized db and app from docker-compose.yml conf
• Branch: fstp_registration

2023-12-05 12:49:33 [ERROR ] (views.show_report) function/symbol 'pango_context_set_round_glyph_positions' not found in library 'libpango-1.0.so.0': /usr/lib/x86_64-linux-gnu/libpango-1.0.so.0: undefined symbol: pango_context_set_round_glyph_positions

Downgrading this package as such: weasyprint = "^52.5" solves the issue. Don't know if it is the best way to do though.

Cheers

Management of proof/evidence related to an answer

A respondent should be able to mark, for each answer, if a proof exist or not. This can be achieved via some kind of flag.
The extra evidence could be a requirement for an auditor.
Evidences won't be uploaded to the server but could be joined for example to a paper version or inserted in the report.

Versioning in case question sets, recommendations or scoring evolve

related to: #19

Easy instantiation of a new Fit4* project

Customization

• customization of Logos, addition of multiple logos;
• customization of legal disclaimers;
• custom about page;
• custom help page (Guidance on how to use this instance, for example).

Adding simple statistics export function

There should be a simple function that exports all stats from a certain period by selecting 2 dates. Then it exports it (to a csv or json file for example) if the surveys have been marked as completed.