Assignment Task

Overview (Secure Design and Developmen)

This assignment requires you to design and develop strictly with the aid of a Large language Model
(LLM), a functional secure system. The assignment consists of the following parts:

 A functional prototype of a secure online system. You have to submit the complete source
code and video report showcasing prototype.
 An individual report of 2000 words that describes the design consideration, development and
testing of the developed prototype.
 Any test/login credentials to the prototype should be included in the files.

The weighting is 100% including all elements. Practical work, written and video reports will be
assessed against the same grading rubric table.

Practical Part Brief

Creative SkillZ LLC hired you as external consultants to help creating their newly proposed
"PixelForge Nexus" system.

Your task is to implement a secure online system, tentatively named "PixelForge Nexus," using any
language/system of your choice with the aid of an LLM (ChatGPT or Google Gemini). The prototype
should contain the following functionality:

Core Functionality
1. Project Management:

a. Add/Remove Projects: Admins can add new game projects (with name, description,
and an initial deadline). Admins can also mark projects as "Completed"

b. View Projects: All users can view a list of active projects.

2. Team Assignment:

a. Assign Team Members: Project Leads can assign developers to their specific
projects.

b. View Assigned Projects: Developers can see a list of projects they are currently
assigned to.

3. Basic Asset & Resource Management:

a. Upload Project Documents: Admins and Project Leads can upload general project
documents (e.g., design docs, meeting notes) associated with a project. We'll skip
version control for assets to simplify, but you can do it for 80%+.

b. View Documents: All users assigned to a project can view its uploaded documents.
Privilege Separation
 Admin: Can add/remove projects, manage all user accounts (create, edit roles), and upload
documents for any project.

 Project Lead: Can assign developers to their projects and upload documents for their
projects.

 Developer: Can view projects they are assigned to and access associated project
documents.

Login Security
 Robust Login System: Essential for secure password hashing and storage (e.g., using
bcrypt).

 MFA Implementation: (Optional but highly recommended): Adding Multi-Factor

Authentication would significantly boost security.

Proposed Pages
 Sign In/Register:

o Allows existing team members to log in.

o Admin-only functionality to register new team members (no self-registration for

simplification).

 User Dashboard (Single Dashboard for All Roles):

o Developers: See a list of their assigned projects with links to documents.

o Project Leads: See projects they lead, with options to assign team members and
upload documents.

o Admins: Access to add/mark projects as complete, and manage user accounts

(add/edit roles).

 Account Settings:

o Users can update their password.

o MFA setup (if implemented).

 Project Details Page:

o Displays project name, description, deadline, assigned team members, and uploaded
documents.
Evidence for Practical Part / Overview of the marking rubric

1. System Design (35%):

a. Produce a design for the system to be implemented and explain what design
and security principles have been considered and why.
b. Describe how the chosen principles or features enhance the functioning and
security of that system in this stage of the development life-cycle.
2. Security testing and analysis (35%):
a. Critically evaluate the application of security techniques and propose the
possible solutions for the issues discovered.
b. Propose solutions for the issues discovered during the testing and analysis
process showing how they can mitigate the detected problems.
3. System Development (20%):
a. Develop and demonstrate functional prototype that complies with the design
provided above, including legal and ethical context of the development.
b. Demonstrate the proper functioning and security mechanisms of the
developed system in accordance with the existing secure development
standards and methodologies.
4. Formal Methods (10%):
a. Application of formal methods, to produce the behavioural model of the
system that will be based on the design or development stage of the system
life-cycle.
b. Verify the correctness of the system with respect to its specification using the
appropriate verification techniques and tools.

Submission Instructions
Submission
Deadline is 28/07/2025 Note that you should submit your own work.
For your submission, you will create and submit a written report (.docx file) that contains 2
links at the top:
 1 link will be to your prototype complete source code in a drive folder.
 1 link will be to your video report.
 The rest of the document will be the Individual Report Brief.
You will upload this .docx file
The complete source code and related documentation MUST be supplied. The source code
should be appropriately and correctly commented. You should also identify any assumptions
that you have made.
Your work will be marked using the grading rubric.

About Video Report

You will also record a video report (a singular video, totalling 8 minutes or less) which
shows:

 A fly-through of the output of the coursework, highlighting the significant aspects of

the work (see the marking rubric below for the aspects that should be covered).
 You are required to use voice-overs and/or text overlays to explain what is happening
in the video.
 The video should be uploaded to GDrive and you should copy a link to the video which
allows people to View the video.

The following issues, in relation to the prototype developed in the practical element of the
assignment, must be included in system documentation:
a) Explanation of the methods and techniques followed in the practical task for the
development of the system
b) Discussion of all the stages of the development life-cycle (e.g., specification,
design, development, etc

Submission Guidelines:

1.⁠ ⁠Upload all deliverables into a single Google Drive folder.

2.⁠ ⁠Do not zip the files.

3.⁠ ⁠Make sure the folder link is set to: ”Anyone with the link can view.”
Assessment Marking Criteria

System Design Security Testing and Analysis System Development Formal Methods
Weighting: 35% Weighting: 20% Weighting: 10%
Weighting: 35% (also Demonstrated in Video)
(also Demonstrated in Video)

80 to 100% Marks above 80 will be awarded Marks above 80 will be awarded Marks above 80 will be awarded for Marks above 80 will be awarded
for going above and beyond the for going above and beyond the going above and beyond the for going above and beyond the
requirements for a distinction and requirements for a distinction and requirements for a distinction and requirements for a distinction and
demonstrate and innovative demonstrate and innovative demonstrate and innovative demonstrate and innovative
approach and insight. approach and insight. approach and insight. approach and insight.

A system design of professional Professional standard security System development is Formal modelling and verification
standards, which is optimized for analysis and testing followed by professionally executed, fully processes are professionally
complying with all the respective applied to the system covering and
the given scenario. security measures that
methods and standards. examining all the potential issues.
significantly improve the overall
The system design demonstrates system security and functioning. The codebase displays exceptional The report demonstrates a deep
a deep understanding of secure The entire security process is code quality and adherence to understanding of formal methods,
design principles. comprehensively documented. secure coding practices. with minimal errors in their
application.
The system design includes a The report includes The documentation of the process
comprehensive threat model that comprehensive test cases and is thorough, including detailed The process is fully documented.
identifies and prioritizes potential results, including code scanning explanations of secure coding
security risks. reports practices.

The system design includes,

clear access control mechanisms,
comprehensive data encryption
strategies.

Detailed documentation illustrates

how security principles are
applied throughout the system
design

70 to 79% Detailed system design fully An extensive security analysis and System development fully Formal modelling and verification
based on the secure design testing has been conducted complies with the secure processes fully examine the
 methodologies and standards. providing mitigation techniques for development methods and functioning and
the identified security issues. standards. security issues of the system
Thorough and well-justified The testing process covers key
documentation. aspects of security. The codebase demonstrates a Formal methods are effectively
The system design is well Test cases and results provide a high degree of adherence to used to analyse and address
structured and display a clear detailed overview of the security secure coding practices, with security concerns, with minimal
understanding of security testing process. minimal security vulnerabilities. errors.
principles and a fully detailed Thorough and well-justified The formal analysis is very well
threat model. Documentation Thorough and well-justified justified in the report.
documentation.
Most security controls are
appropriately integrated into the
design, with effective strategies
for reducing threat.

60 to 69% System design incorporates an A medium range of security System development fully Formal modelling and verification
extensive range of principles analysis and testing techniques complies with the proposed processes extensively examine a
which are very well discussed in have been used providing design, but partially with the wide range of functioning and
the report. effective solution for the detected secure development methods security issues. The formal
The system design shows problems. Process is very well and standards. analysis is very well described in
awareness of security concerns described in the report. Process is very well described in the report
but may lack detail in threat the report.
modelling.
Most security controls are present
but need further clarification.

50 to 59% System design incorporates the A small range of security analysis System development considers Behavioural model presents the
principles required for the proper and testing techniques have been basic functioning and limited basic functioning of the system
functioning and security of the used providing the respective security of the system with good incorporating security aspects as
system but required more details. solutions. explanation of the development well. Verification examines the
Adequate discussion in the Test cases and results are stage. basic security issues. Adequate
report. provided but may lack The system development phase discussion in the report.
completeness. has basic security measures in
Adequate discussion in the report place, but there are notable areas
where secure coding practices
could be improved.
40 to 49% System design meets the basic Very limited security analysis and System development complies A very basic attempt of modelling
requirements with lack of details. testing of the system with very few with the requirement of a basic the behaviour of the
Short discussion in the report. solutions provided. design. system and then verify it. Short
Security controls are present, but Test cases and results are limited Short discussion in the report. discussion in the report.
it is generic or incomplete. in scope.
Short discussion in the report.

Fail No system design built or There is no evidence of security No system developed or No or very poor application of
30, 35% incomplete design provided. testing or analysis provided or incomplete implementation of the formal methods to the system
which is severely deficient in very poor system security and system. analysis.
security aspects testing carried out with no No attention to system security
recommended solutions.

Fail The system design is entirely No attempt or no system security Outcome not met or no system No attempt or no application of
0 to 29% devoid of security considerations testing carried . developed formal methods to the system
and outcome not met or no analysis.
system design built