GSIC - SLAM, 2024 session

Access logging demonstrates compliance (GDPR/CNIL), detects and proves who accessed what data (accountability, probative value) and helps manage security incidents. It is an obligation under Article 32 of the GDPR (security measures).

a) Backup aims to restore data in the event of loss/failure (continuity objective); archiving aims to preserve data with legal/evidentiary value over the long term (evidence objective).

b) Authentication logs are archived to meet the legal retention obligation (evidence and traceability for the required duration).

The procedure provides for compression with encryption → confidentiality is ensured. On the other hand, the transfer is carried out without verifying checksums (fingerprint) → integrity is NOT guaranteed: there is no way to detect alteration of the logs during archiving. A cryptographic hash (digest) verified on receipt should be added.

We combine accounts from the different databases with their origin, setting NULL for missing fields:

CREATE VIEW v_liste_comptes AS
SELECT 'Personnel' AS origine, nom, prenom, compte_login, roles
FROM Personnel.utilisateur
UNION ALL
SELECT 'Logistique' AS origine, nom, prenom, compte_login, roles
FROM Logistique.utilisateur
UNION ALL
SELECT 'Formation' AS origine, nom, prenom, login AS compte_login, NULL AS roles
FROM Formation.utilisateur;

: provide an Compte table (origin, surname, first name, login, application) and a Role table linked to accounts (one identifier per role specific to an application), via a Compte-Role association table.

a) Create the application account:

CREATE USER 'prep_sso'@'localhost' IDENTIFIED BY '<mot_de_passe_fort>';

b) Permissions strictly necessary for the program (reading the view + writing to the inventory) - least privilege:

GRANT SELECT ON BdInventaire.v_liste_comptes TO 'prep_sso'@'localhost';
GRANT INSERT ON BdInventaire.*               TO 'prep_sso'@'localhost';

a) The staff member who disclosed their credentials breached the IT policy (sharing personal, named access credentials).

b) The intern is at fault: they logged into a system they had no right to access (unauthorised access).

c) Risks: disciplinary action for the employee, and potential criminal liability for the intern (fraudulent access to a system, Art. 323-1 of the Criminal Code).

The IT policy is only binding on employees if it is annexed to the internal regulations (filing/consultation procedure complied with) and brought to their attention (signed/communicated).

Health data: medical fitness, medical history/exam results, blood group/Rhesus, etc. - special categories within the meaning of Article 9 of the GDPR.

Even if access via the application is secure, an actor with direct access to the database (database administrator, service provider) or the theft of a backup would allow data to be read in plain text. Column encryption (key stored outside the database) protects against this direct access.

-- Accès direct : la donnée apparaît chiffrée (illisible)
SELECT rhesus FROM PatientAnonyme;

-- Accès via la vue (utilisateur habilité, certificat) : donnée déchiffrée
SELECT rhesus FROM v_PatientAnonyme;   -- la vue déchiffre la colonne

: if the controller methods do not verify authorisation (or build queries using concatenation), the API exposes unauthorised access and injections → breach of confidentiality and integrity.

: the issue stems from the token audience (the 'audience' for which the JWT is issued) or the training audience: the token must be regenerated/addressed to the correct recipient for the API to accept it.

Most likely hypothesis: the JWT token has expired (its lifespan was exceeded during the break). Signature/validity verification fails → the API returns invalid_token.

Without parameters, it uses the current refresh token to request a new access token from the SSO server and returns it:

getToken() :
    réponse = appel SSO (/token) avec le refresh_token courant
    nouveauJeton = réponse.access_token
    mettre à jour le jeton stocké
    retourner nouveauJeton

a) With SSO, a single compromised account gives access to ALL applications → severity increases (the risk moves to a higher level on the matrix).

b) Improvement: add multi-factor authentication (MFA) → reduces the likelihood of a compromised account being exploited, bringing the risk down to an acceptable level.

An 8-character password offers greater protection against brute-force attacks: its keyspace of combinations is much larger (letters + digits + special characters across 8 positions) than a 4-digit PIN (only 10,000 combinations).

Facial recognition relies on biometric data, which is sensitive personal data under the GDPR (Article 9). Its processing is strictly regulated: it requires a lawful basis (often consent), a data protection impact assessment (DPIA), and cannot be made mandatory (an alternative - such as a password - must remain available), unlike a password.

It inserts a log entry (date/time, user, action) into the SQLite database via a parameterised query:

public void ajouterEntreeLog(EntreeLog uneEntree) {
    SQLiteDatabase db = this.getWritableDatabase();
    ContentValues valeurs = new ContentValues();
    valeurs.put("dateHeure", uneEntree.getDateHeure());
    valeurs.put("utilisateur", uneEntree.getUtilisateur());
    valeurs.put("action", uneEntree.getAction());
    db.insert("Log", null, valeurs);   // insertion paramétrée
    db.close();
}