◇ OpenCyber Academy
Engineering · Chapter 15 · English

Chapter 15 — Security fundamentals

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 15 — Security fundamentals

Lesson map

Lesson 15 published. Map, example, EX043.

flowchart TD
  N0["Learning outcomes"]
  N1["15.1 CIA"]
  N2["15.2 Assets and threats"]
  N3["15.3 OWASP Top 10:2021"]
  N4["15.4 Controls"]
  N5["15.5 Defence in depth"]
  N6["Security requirements early"]
  N7["Least privilege principle"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX043"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["15.1 CIA"]
  N2["15.2 Assets and threats"]
  N3["15.3 OWASP Top 10:2021"]
  N4["15.4 Controls"]
  N5["15.5 Defence in depth"]
  N6["Security requirements early"]
  N7["Least privilege principle"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX043"]

[Learning outcomes]
    |
    v
[15.1 CIA]
    |
    v
[15.2 Assets and threats]
    |
    v
[15.3 OWASP Top 10:2021]
    |
    v
[15.4 Controls]
    |
    v
[15.5 Defence in depth]
    |
    v
[Security requirements early]
    |
    v
[Least privilege principle]
    |
    v
[Worked example] --> [Exercise EX043]

Learning outcomes

You will (1) explain confidentiality, integrity and availability for applications; (2) identify assets, threats and controls; (3) describe the OWASP Top 10 categories; (4) apply defence in depth.

15.1 CIA

Confidentiality keeps rider data private; integrity ensures tickets and prices are not altered and that deployed code is what was built; availability keeps ticket sales running. Supply-chain attacks are mainly integrity attacks on code.

The three properties can conflict. Strict checks that stop every unsigned artifact protect integrity but may block an urgent release if signing is broken, harming availability. Teams decide in advance which property wins in which situation. For ticket-web, integrity of deployed code comes first, since a tampered release could harm every rider at once, while a short delay to a release affects nobody's safety.

15.2 Assets and threats

Assets: payment tokens, rider accounts, the build pipeline, signing keys. Threats: criminals seeking payment data, fraudsters seeking free tickets, attackers targeting the pipeline to reach many riders.

Listing assets first prevents the team from focusing only on threats they find interesting. The build pipeline and signing keys appear because they let an attacker reach every rider through one compromise. Each threat is linked to the assets it wants: criminals to payment tokens, fraudsters to ticket and price logic, pipeline attackers to signing keys. Motivation helps predict effort; fraudsters probing for free tickets are numerous but rarely sophisticated.

15.3 OWASP Top 10:2021

The ten categories are Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable and Outdated Components, Identification and Authentication Failures, Software and Data Integrity Failures, Security Logging and Monitoring Failures, and Server-Side Request Forgery. The tmpl advisory relates to Vulnerable and Outdated Components (A06); the mirror mismatch to Software and Data Integrity Failures (A08).

The categories are ranked by data from many organisations and include both specific mistakes and broad design problems. They are useful for training and for sorting findings, as Kwame's classification later shows. Each category links to further guidance, and the matching ASVS chapters give testable requirements.

15.4 Controls

Preventive (validation, least privilege), detective (logs, advisory checks) and corrective (patching, rollback).

Each type answers a different question. Preventive controls stop something happening, such as validation rejecting a bad zone. Detective controls tell the team it happened, such as the advisory check spotting a vulnerable component already deployed. Corrective controls restore a good state, such as rolling back to the previous signed release. A plan with only preventive controls has no answer when prevention fails, which it eventually will. For the tmpl advisory, Coastline used all three: review rules for template use, the daily advisory check and a fast upgrade.

15.5 Defence in depth

No control is perfect; layers mean one failure does not lead to disaster.

For ticket-web, the template flaw shows the idea. Escaping in tmpl failed for some attributes, but validation had already limited what users could put in most fields, and the web application firewall at the edge blocked some common attack patterns. None of these layers alone was complete. Together they meant that the flaw, although real, was much harder to misuse. Layers should fail for different reasons; three copies of the same check add little, because one bypass defeats all of them.

Security requirements early

Kwame learns that fixing a design flaw after release costs far more than avoiding it during design, because code, tests, documentation and users all depend on the design. OWASP Top 10:2021 added Insecure Design (A04) to stress this. Coastline therefore asks security questions in planning meetings, such as "who should be allowed to do this?" and "what happens if this input is wrong?", before any code is written.

Least privilege principle

Every person and program gets only the access needed for its task, no more.

Worked example

Kwame classifies Coastline's last year of findings by Top 10 category: most were A01 and A06. Ingrid uses this to prioritise authorisation tests and dependency updating.

Synthetic case. Findings are synthetic.

Errors and limits

The Top 10 is an awareness document, not a complete standard; use ASVS for verification.

Exercises

Synthesis

CIA, threats and layered controls frame every later chapter.

Continue studying — chapter 15 of 50

← Chapter 14 (draft) · Course chapter index · Chapter 16 (draft) →