Chapter 5 — Security literacy | Technologist Application and software supply chain security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Security literacy

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Core ideas"]
  N2["5.2 OWASP Top 10:2021"]
  N3["5.3 Advisories"]
  N4["5.4 CWE"]
  N5["5.5 Supply chain risk"]
  N6["5.6 Talking to clients"]
  N7["Severity in context"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Core ideas"]
  N2["5.2 OWASP Top 10:2021"]
  N3["5.3 Advisories"]
  N4["5.4 CWE"]
  N5["5.5 Supply chain risk"]
  N6["5.6 Talking to clients"]
  N7["Severity in context"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 Core ideas]
    |
    v
[5.2 OWASP Top 10:2021]
    |
    v
[5.3 Advisories]
    |
    v
[5.4 CWE]
    |
    v
[5.5 Supply chain risk]
    |
    v
[5.6 Talking to clients]
    |
    v
[Severity in context]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) explain core application security concepts; (2) use the OWASP Top 10:2021 categories; (3) read advisories and CWE names; (4) explain supply-chain risk to clients.

5.1 Core ideas

Confidentiality (pet owners' details), integrity (bookings, prices and the code itself) and availability (clinics need bookings to work). Each of the three ideas maps onto a concrete harm for Greenleaf. A leak of owners' phone numbers or pet medical notes breaks confidentiality. A changed price, a booking moved to another day, or a library altered before it reached the build breaks integrity. A booking page that stops working during a busy morning breaks availability and sends clients to phone the clinic instead. Diego uses these three words when he explains to clients why a library update matters to them.

5.2 OWASP Top 10:2021

Categories include Broken Access Control (A01), Injection (A03), Insecure Design (A04), Security Misconfiguration (A05), Vulnerable and Outdated Components (A06) and Software and Data Integrity Failures (A08). The January upload-kit case is an A06 problem. Naming the category helps Diego find the right guidance quickly instead of treating each advisory as a new kind of problem. When Diego meets a new finding, he names its category before deciding what to do, because each category's page lists typical causes and defences. The CSV export found later in the course, which any staff account could reach, is a Broken Access Control problem (A01), while the unsigned payment callback relates to Software and Data Integrity Failures (A08).

5.3 Advisories

An advisory lists the package, affected and fixed versions, severity and a description. Diego learns to read the fixed version first: it tells you what to upgrade to. For upload-kit, the January advisory gave the affected range as at least 2.0.0 and below 3.2.0, which made 3.2.0 the fixed version to install. Diego also notes the publication date, because it starts the remediation clock that Brightwave later measures for every client. He reads the description last and only to judge whether the affected feature is used by a given client. A severity score alone does not tell him whether that feature is used.

5.4 CWE

The CWE Top 25 names weaknesses such as unrestricted upload of dangerous file types (CWE-434), relevant to Greenleaf's upload feature. Advisories often name a CWE, so the identifier links a specific library flaw to a general class of weakness and its documented defences. CWE-434 points Diego towards checking type, content and storage for every upload, not only for the upload-kit version that was flagged. That is the thinking behind the upload checks built later in the course. Diego notes the CWE identifier in each task, so similar findings can later be grouped.

5.5 Supply chain risk

Ohm et al. (2020) and Ladisa et al. (2023) describe how attackers target packages, build systems and distribution, not just applications. Defenders respond with inventories, updates, integrity checks and provenance. For Brightwave, the January case was the simplest kind of supply chain problem: an honest library with a published flaw. The literature also describes deliberately harmful versions and compromised build systems, which an inventory alone would not stop. That is why Brightwave adds pinning, review of dependency changes and recorded builds alongside the inventory.

5.6 Talking to clients

Clients want to know: are we affected, what did you do, do we need to do anything? Diego practises answering these in three sentences. For Greenleaf the three answers were yes, the library was updated on 14 January, and no action was needed. The note Diego later drafts for Greenleaf follows exactly that order of answers. For harbour-cafe, which never used upload-kit, the honest answer to the first question was simply no. Each answer is a plain sentence without jargon, and none promises more than the record shows. If Brightwave does not yet know whether a client is affected, the answer says so and gives a time for the follow-up.

Severity in context

An advisory's severity is general. For a given client, Diego asks whether the affected feature is used and whether it is reachable from the internet. upload-kit's flaw mattered for Greenleaf because uploads were open to any visitor booking an appointment.

Learning sources

Diego follows the advisory feeds for the ecosystems Brightwave uses and reads the OWASP Top 10 pages for each category he meets in practice.

Worked example

Diego drafts the note to Greenleaf: "A library used in your booking site's upload feature had a published security flaw. We updated it on 14 January and checked that uploads still work. You do not need to take any action." Aiko approves it unchanged.

Synthetic case. The note is synthetic.

Errors and limits

The Top 10 is an awareness list; use ASVS for detailed requirements.

Exercises

EX013 — Category. Which Top 10 category is the upload-kit case? Rubric: 3 = A06; 2 = partial; 1 = vague; 0 = none.
EX014 — CWE-434. What is CWE-434? Rubric: 3 = unrestricted upload of dangerous file types; 2 = partial; 1 = vague; 0 = none.
EX015 — Client questions. What three questions do clients ask? Rubric: 3 = affected? what done? action needed?; 2 = two; 1 = one; 0 = none.

Synthesis

Shared vocabulary lets you read advisories and explain risk to clients.

Continue studying — chapter 05 of 30

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →