OpenCyber Academy
Bachelor's · Chapter 5 · English
Course code: OCA-106Chapter 05: OCA-106-C005

Chapter 5 — Security literacy

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 CIA"]
  N2["5.2 OWASP Top 10:2021"]
  N3["5.3 Supply chain risks"]
  N4["5.4 Reading advisories"]
  N5["5.5 Weakness names"]
  N6["Severity"]
  N7["Keeping up"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 CIA"]
  N2["5.2 OWASP Top 10:2021"]
  N3["5.3 Supply chain risks"]
  N4["5.4 Reading advisories"]
  N5["5.5 Weakness names"]
  N6["Severity"]
  N7["Keeping up"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 CIA]
    |
    v
[5.2 OWASP Top 10:2021]
    |
    v
[5.3 Supply chain risks]
    |
    v
[5.4 Reading advisories]
    |
    v
[5.5 Weakness names]
    |
    v
[Severity]
    |
    v
[Keeping up]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) explain core security concepts for applications; (2) describe the OWASP Top 10:2021 categories; (3) recognise software supply chain risks; (4) read a security advisory.

5.1 CIA

Confidentiality protects student details and order history; integrity protects prices, orders and the code itself; availability keeps ordering working at lunchtime.

Lena applies the three properties to each part of her diagram. The leaked token was a confidentiality failure; it was a test key, but a live key leaked the same way could have allowed fraudulent charges. The hash mismatch protected the integrity of the code. A lunchtime outage would harm availability most, since that is when nearly all orders are placed. Ranking the properties for each part helps the society choose where to spend effort first.

5.2 OWASP Top 10:2021

The ten categories are Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable and Outdated Components, Identification and Authentication Failures, Software and Data Integrity Failures, Security Logging and Monitoring Failures, and Server-Side Request Forgery. The token leak relates to misconfiguration and authentication; the hash mismatch to software and data integrity.

Lena uses the list to tag each finding in the CampusEats issue tracker, which shows which categories recur. After one term, misconfiguration is the most frequent tag, which tells the society to review its deployment settings before writing new features. Categories are a vocabulary for sorting problems, not a checklist that proves an application is secure.

5.3 Supply chain risks

Ohm et al. (2020) reviewed real cases of malicious open-source packages; Ladisa et al. (2023) organised attacks on open-source supply chains into a taxonomy from source to distribution. Consumers like CampusEats face both known vulnerabilities in honest packages and, more rarely, deliberately malicious ones.

The first is far more common. Lena's reading shows that most malicious packages rely on simple tricks, such as names close to popular packages, so careful review of new dependencies catches many of them. Known vulnerabilities need a different control: keeping track of which versions CampusEats uses and updating when a fix appears.

5.4 Reading advisories

An advisory names the package, affected versions, fixed versions, severity and a description. A CVE identifier allows cross-referencing.

Lena practises on an advisory for a package CampusEats uses. She checks whether the installed version falls in the affected range, whether the vulnerable feature is actually used, and whether the fixed version can be installed without breaking anything. She records her answer in the issue tracker with a link to the advisory, so that the decision can be reviewed later. Severity alone does not decide urgency; exposure does.

5.5 Weakness names

The CWE Top 25 names common weaknesses like cross-site scripting (CWE-79) and SQL injection (CWE-89).

Weakness names describe the kind of mistake rather than a specific product, so they connect advisories with the code review checklist. When Lena finds a place where CampusEats builds a database query from text, she links it to CWE-89, and the fix follows a known pattern. Using the same names across reviews, advisories and training helps the society see which mistakes it makes most often. It also aids training.

Severity

Advisories include severity scores, often using CVSS. Severity describes how bad a flaw could be in general, not how bad it is for CampusEats. Lena learns to ask two more questions: is the affected function used, and is the system exposed to the internet? EPSS (Jacobs et al., 2021) adds an estimate of how likely exploitation is.

Keeping up

Lena subscribes to advisories for the packages CampusEats uses, through the registry's notification feature.

Worked example

Lena reads an advisory for date-tools affecting versions below 0.4.0. CampusEats uses 0.4.2, so it is not affected. She records the check in the society's tracker, so nobody repeats it.

Synthetic case. The advisory is synthetic.

Errors and limits

Advisory version ranges can be wrong; check the fix notes when in doubt.

Exercises

Synthesis

Shared vocabulary lets you read advisories and reason about risk.

Continue studying — chapter 05 of 40

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →

Worked answers

EX013. Prices and the code itself.

EX014. The leak: security misconfiguration and authentication failures; the hash mismatch: software and data integrity failures.

EX015. No; it uses 0.4.2, above the affected range.