Chapter 5 — Security literacy

Chapter 5 — Security literacy

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Core concepts"]
  N2["5.2 Attacks on retailers"]
  N3["5.3 Controls for attacks"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Core concepts"]
  N2["5.2 Attacks on retailers"]
  N3["5.3 Controls for attacks"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 Core concepts]
    |
    v
[5.2 Attacks on retailers]
    |
    v
[5.3 Controls for attacks]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) explain core security concepts in plain language; (2) recognise common attack patterns against retailers; (3) relate controls to the attacks they address.

5.1 Core concepts

Lucas learns the language of security: confidentiality, integrity and availability; assets, threats, vulnerabilities and risk; authentication and authorisation. He practises explaining each to a Fernway store manager without jargon. Confidentiality means only the right people see customer details; integrity means prices and orders cannot be changed without permission; availability means the shop stays open online. Being able to explain concepts plainly is part of security literacy, because architects must persuade non-specialists to fund and follow controls. If the manager cannot repeat the idea in her own words, the explanation has not yet worked.

5.2 Attacks on retailers

Hannah describes attacks Fernway faces. Phishing emails impersonating suppliers ask staff to change bank details. Credential stuffing uses passwords leaked from other sites to log in to member accounts. Skimming scripts injected into checkout pages steal card details as customers type. Gift-card fraud exploits weak checks on balance enquiries. Lucas notes that most do not break cryptography or exploit exotic flaws; they abuse ordinary processes and weak authentication. Architecture must therefore cover business processes and people, not only servers and networks.

5.3 Controls for attacks

Lucas matches controls to attacks. Supplier bank-detail changes require a phone call to a known number and two approvals. Credential stuffing is reduced by rate limiting, checking passwords against known breached lists and offering multi-factor authentication. Checkout skimming is reduced by limiting third-party scripts, using content security policy and monitoring page changes. Gift-card fraud is reduced by rate limits and requiring the card number plus a PIN. Each control addresses a specific attack path, and he can explain why it exists, which helps staff accept it.

Worked example

Lucas explains five core concepts to a store manager, lists four retail attacks and matches each to controls.

Synthetic case. Attacks and controls at Fernway are synthetic.

Errors and limits

Attack patterns change; lists need regular updating. Controls can shift attacks elsewhere rather than stopping them.

Exercises

• EX013 — Integrity in retail. Give a retail example of integrity. Rubric: 3 = prices and orders cannot be changed without permission;; 2 = example;; 1 = confidentiality;; 0 = none.
• EX014 — Credential stuffing. What is credential stuffing and one control against it? Rubric: 3 = logging in with passwords leaked elsewhere; rate limiting, breached-password checks or MFA;; 2 = both;; 1 = vague;; 0 = none.
• EX015 — Bank-detail control. How should supplier bank-detail changes be verified? Rubric: 3 = phone call to a known number plus two approvals;; 2 = both;; 1 = email reply;; 0 = none.

Synthesis

Security literacy means explaining concepts plainly and connecting real attacks to specific controls.

Continue studying — chapter 05 of 40

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →