CSE298 Lectures 14 - 26

The Great Amalgamation

Spring 2025
Damon Katz, Mark Erle, and Alex Clevenger
CSE298 Cybersecurity - Lecture 14
Introduction to Cyber-Physical
Systems and Their Security
Challenges
Spring 2025
Mark Erle
Most Common Threat Vectors for Accessing a Network
● Phishing Attacks: Social eng’g tactics that trick users into revealing credentials or installing malware.
● Malware Infections: Malicious software (viruses, ransomware, trojans) that exploits vulnerabilities to
gain unauthorized access.
● Remote Access Vulnerabilities: Weaknesses in remote desktop, VPNs, or other remote access
solutions that allow attackers to bypass perimeter defenses.
● Insecure Wireless Networks: Unsecured or poorly configured Wi-Fi networks that can be exploited.
● Unpatched Software and Vulnerabilities: Outdated operating systems or applications with known
vulnerabilities that attackers can exploit.
● Insider Threats: Malicious or negligent actions by employees or contractors that provide access to
sensitive systems.
● Network Misconfigurations: Incorrectly configured firewalls, routers, or access controls creating
exploitable gaps in security.
● Third-Party Vendor Risks: Compromised or overly permissive access from vendors or partners that
can serve as a backdoor into the network.
● Brute Force and Credential Stuffing: Automated attempts to guess or reuse stolen passwords.
● Application vulnerabilities: SQL injection, buffer overflow, etc., often in conjunction with malware.
3
Introduction to CPS & Security Challenges
● Overview:
○ What are Cyber-Physical Systems (CPS)?
■ Integrated systems where computational elements (cyber
components) and physical processes interact closely.
■ Combination of software, hardware, & networked sensors/actuators
to monitor and control physical environments in real time.
○ Key applications: smart grids, autonomous vehicles, industrial control
● Our focus:
○ Understanding CPS fundamentals
○ Exploring unique security challenges
○ Introducing threat modeling and risk assessment tailored to CPS
4
Introduction to Cyber-Physical Systems
● Definition:
○ Integration of computational (cyber) and physical processes to control
critical infrastructure
● Key Applications:
○ Smart grids, autonomous vehicles, industrial control systems
● Significance:
○ CPS are essential for modern automation and efficiency in critical sectors
○ Their security directly affects both digital and physical safety
● How do CPS differ from traditional IT systems in terms of impact?

5
Security Challenges in CPS - Core Threats
● Real-Time Constraints:
○ Necessity for timely response in control systems
○ Delays can lead to system instability or catastrophic failures
● Physical Impact of Cyberattacks:
○ Cyber incidents can cause direct physical harm (e.g., power outages,
machinery malfunctions)
○ Elevated safety risks compared to purely digital systems
● Embedded System Vulnerabilities:
○ Susceptible to hardware hacking, RF interference, and firmware exploits
○ Limited processing power can constrain advanced security measures
● What are the consequences when a cyberattack in a CPS results in physical
damage?
6
Security Challenges - Complexity and Sensor Proliferation
● Complexity in Integration:
○ CPS consist of numerous, diverse sensors and controls, creating a vast attack
surface
○ Difficulty in securing and managing a large number of endpoints
● Increased Attack Surface:
○ More devices and connections offer additional entry points for attackers
○ Ensuring consistent security across all components is challenging
● Monitoring & Coordination Challenges:
○ High volume of data from sensors can overwhelm traditional monitoring
systems
○ Coordination of timely responses across distributed systems becomes complex
● Potential for Misconfigurations:
○ Increased risk of configuration errors leading to vulnerabilities
● How does the sheer number of sensors and controls in a CPS complicate overall
security management? 7
Threat Modeling & Risk Assessment in CPS
● Threat Modeling:
○ Identify attack surfaces in both cyber and physical domains
○ Map vulnerabilities and potential attack vectors specific to CPS
● Risk Assessment:
○ Evaluate the likelihood and impact of attacks (e.g., safety, economic,
operational)
○ Use frameworks (e.g., STRIDE) tailored to CPS environments
● Case Example:
○ Analyzing the risks associated with compromised PLCs in a smart grid
● How can threat modeling in CPS differ from traditional IT threat modeling?

8
STRIDE Framework - Threat Modeling Methodology
● Used to identify and classify security threats in a system. Each letter in
STRIDE represents a specific category of threat:
○ S (Spoofing): Impersonation of users or devices.
○ T (Tampering): Unauthorized modification of data or system components.
○ R (Repudiation): The ability for users to deny actions they performed.
○ I (Information Disclosure): Exposure of sensitive information to
unauthorized parties.
○ D (Denial of Service): Disruption of service availability.
○ E (Elevation of Privilege): Gaining unauthorized permissions to perform
restricted actions.
● But how would one actually apply this methodology?
9
Applying the STRIDE Methodology
● Model the System:
○ Develop a Data Flow Diagram (DFD) or similar system model that identifies all components (e.g.,
processes, data stores, external entities, data flows).
○ Show your data enters, moves around, leaves your network, and who handles it along the way
● Apply STRIDE to Each Element:
○ For each component in the DFD, systematically ask how each STRIDE category might apply. For example:
■ Spoofing: Can an attacker impersonate a user or device interacting with this component?
■ Tampering: Is it possible for someone to alter data or code here?
■ Repudiation: Could actions performed by users be denied later?
■ Information Disclosure: What sensitive data could be exposed?
■ Denial of Service: How might service availability be disrupted?
■ Elevation of Privilege: Can an attacker gain higher-level permissions through this component?
○ Document Threats:
■ Record each identified threat, linking it to the corresponding component in the system model.
○ Prioritize and Classify Risks:
■ Evaluate the impact and likelihood of each threat.
■ Classify them based on severity, which helps in prioritizing mitigation efforts.
○ Design Mitigation Strategies:
■ Develop specific countermeasures (e.g., authentication improvements, data validation, encryption)
for each category of threat identified through STRIDE. 10
11
Integrating Cryptography into CPS Security
● Role of Cryptography:
○ Ensuring secure communication between components of a CPS
○ Protecting data integrity and confidentiality in real-time systems
● Practical Challenges:
○ Balancing robust encryption with real-time performance demands
○ Managing keys and nonces in dynamic, distributed systems
● What trade-offs might engineers face when integrating cryptographic solutions
into CPS?

12
Case Studies - Vulnerability, Exploit, and Mitigation
● Stuxnet Worm - covered in Prof. Chuah’s presentation
● Ukrainian Power Grid Attack - covered in Prof. Chuah’s presentation
● Automotive CAN Bus Exploits
● Water Treatment Plant Attack
● Smart Meter Vulnerabilities in Utility Networks

13
 CSE298 Cybersecurity - Lecture 15
Methods for Securing CPS, PLCs, and
Embedded Systems
Spring 2025
Mark Erle
Expanded Set of Challenges Unique to Securing CPS
● Physical Safety Risks
● Conflicting IT/OT* Priorities
● Legacy and Heterogeneous Devices (with a mix of outdated features/protocols)
● Real-Time Operational Constraints (can limit use of more robust algorithms)
● Expanded Attack Surface
● Security-by-Design Gaps
● Specialized Threat Landscape (need to understand broad array of devices)
● Regulatory and Compliance Complexity (need to satisfy multiple standards)

* Operational Teams wanting maximal uptime and ease-of-use often clash with IT

15
Securing CPS – Overview of Methods
● Resilient Control Systems
○ What is meant by resiliency?
○ How might resilient control systems contribute to both safety and
security?
● Intrusion Detection/Prevention (IDS/IPS)
○ What might be a key indicator of an intrusion in a CPS environment?

16
Securing CPS – Resilient Control Systems
● Resilient Control Systems:
○ Redundancy: Deploy multiple redundant channels and backup controllers
to sustain operations during component failure
○ Adaptive Control: Implement control algorithms that adjust dynamically to
system changes or detected threats
○ Case Study: Industrial water treatment plants using redundant sensors to
verify readings and ensure safe chemical dosing

17
Securing CPS – IDS/IPS
● IDS/IPS for CPS:
○ Anomaly Detection: Leverage statistical models and machine learning to
identify deviations from normal operational patterns
○ Real-Time Response: Configure automated countermeasures that isolate
affected segments or switch to backup systems
○ Deployment Challenges: Calibrating thresholds to avoid false positives
while ensuring timely threat detection
● What are the benefits of integrating adaptive control methods with IDS/IPS in
a CPS environment?

18
So What Exactly is a PLC?
● A Programmable Logic Controller (PLC) is a specialized industrial computer
● Designed to automate and control machinery or processes in industrial
environments
● It continuously monitors input devices (e.g., sensors, switches) and executes
pre-programmed instructions to control output devices (e.g., actuators,
motors)
● Widely used in manufacturing, assembly lines, and other automated systems
due to their reliability, flexibility, and ability to withstand harsh conditions
● Key features include:
○ Real-Time Operation
○ Resource constraints
19
And What is Meant by the Term Embedded System?
● A specialized computer system designed to perform dedicated functions
within a larger mechanical or electronic system
● Usually consist of a microprocessor or microcontroller, memory, input/output
devices, and a power supply
● Key characteristics include:
○ Dedicated functionality
○ Resource constraints
○ Real-time operations

20
Securing PLCs and Embedded Systems
● Programmable Logic Controllers (PLCs):
○ Common Vulnerabilities: Legacy code, weak authentication, outdated firmware
○ Mitigation Strategies:
■ Regular firmware updates and patch management
■ Restrict remote access through strict network segmentation and VPNs
■ Use of digital signatures to validate firmware integrity
● Embedded Systems:
○ Challenges: Limited processing power and memory; often use proprietary
protocols
○ Security Enhancements:
■ Secure boot processes to verify the integrity of the system at startup
■ Hardened operating systems with minimal services and attack surfaces
■ Encryption for data stored and transmitted by embedded devices
21
Best Practices
● Periodic vulnerability assessments and penetration testing of industrial devices
● Establishing a secure supply chain for hardware components
● Implement Role-Based Access Control (RBAC):
○ Restrict management and configuration access to only those who require it,
ensuring that any changes to PLC or embedded systems are tightly controlled.
● Comprehensive Logging and Anomaly Detection:
○ Establish continuous monitoring and logging of system activity. Use SIEM tools
or specialized IDS/IPS for industrial systems to detect unusual patterns or
unauthorized access attempts promptly.
● How can secure boot and firmware validation help protect PLCs from malicious
reprogramming? Wait, what?

22
Securing Embedded Systems – RF & Hardware Hacking
● RF Security:
○ Vulnerabilities: Interception of wireless signals, jamming, spoofing
○ Mitigations:
■ Use robust encryption (e.g., AES) on wireless communications
■ Implement frequency hopping or spread spectrum techniques to thwart
interference
■ Monitor RF spectrum for anomalies
● Hardware Hacking:
○ Threats: Physical tampering, side-channel attacks, reverse engineering
○ Protective Measures:
■ Tamper-evident and tamper-resistant hardware design
■ Physical enclosures, secure key storage (e.g., hardware security modules)
■ Obfuscation and code signing to protect firmware integrity
● Implementation Challenges:
○ Balancing cost, performance, and security in hardware design
○ Integrating physical security with cyber controls in a unified strategy
● In what ways does frequency hopping contribute to RF security in embedded systems? 23
Integrated Security & Best Practices
● Layered Defense Strategy:
○ Combine resilient control systems, tailored IDS/IPS, secure PLC/embedded system
measures, and RF protections
○ Ensure overlapping security controls to cover weaknesses in any one layer
● Coordination & Monitoring:
○ Continuous monitoring through a centralized security information and event
management (SIEM) system
○ Regular audits, risk assessments, and vulnerability scanning for all CPS components
● Standards & Frameworks:
○ Adhere to guidelines such as NIST SP 800-82, IEC 62443 for industrial control
systems
○ Establish incident response plans specific to CPS scenarios
● Future Directions:
○ Explore emerging technologies like AI for anomaly detection in CPS environments
○ Investigate adaptive security frameworks that adjust in real time to threat intelligence
● How does a layered defense model reduce the risk of widespread compromise in CPS?
24
CSE298 Cybersecurity - Lecture 16
Identity and Access Management -
Authentication and Authorization
Spring 2025
Mark Erle
Introduction to Identity and Access Management (IAM)
● What is IAM?
○ Managing digital identities and access rights across an organization
○ Balances security with usability
○ Essential for reducing insider threats and external breaches
● Core components:
○ Authentication
○ Authorization
○ Identity governance & lifecycle management
○ Privileged account management
● Why is IAM critical for cybersecurity in an organization?

26
Authentication Overview
● Authentication:
○ Verifying users’ claimed identities
● Authentication factors:
○ Something you know (passwords) ⇐ a.k.a., knowledge
○ Something you have (token, smart card) ⇐ a.k.a., possession
○ Something you are (biometrics) ⇐ a.k.a., inherence
● Challenges:
○ Credential theft, reuse, brute-force attacks
○ Privacy concerns (biometrics)
● How do different authentication methods influence security strength?

27
Password Security and Entropy
● Entropy and Password Strength:
○ Measure of password unpredictability
○ Longer passwords with varied character types increase entropy
● Common Attacks:
○ Brute-force attacks (dictionary attack is a subset)
○ Rainbow table attacks
○ Credential stuffing
● Mitigation:
○ Storing passwords securely:
■ Password hashing (not plaintext!)
■ Salting to defend against rainbow table attacks
○ Cryptographic hashing algorithms:
■ Recommended: Argon2, bcrypt, scrypt, PBKDF2
■ Slows down brute-force attacks
○ Password-Authenticated Key Exchange (PAKE): ⇐ Read in Wong text!
■ Securely establishes cryptographic keys based on passwords, preventing
exposure if intercepted
● Why are cryptographic hash functions critical in protecting authentication credentials? 28
Biometrics in Authentication
● Types:
○ Fingerprints, facial recognition, iris scans
● Strengths:
○ Difficult to replicate
○ User-friendly
● Risks:
○ Privacy concerns ⇐ How to address?
○ False positives/negatives
○ Irrevocability if compromised
● How do biometric systems balance security benefits with privacy risks?

29
Multi-Factor Authentication (MFA)
● What is MFA?
○ Using two or more different authentication factors
● Advantages:
○ Reduces risks from password theft
○ Highly effective in preventing unauthorized access
● Challenges:
○ User inconvenience
○ Implementation complexity
● What makes MFA significantly more secure than single-factor authentication?

30
Authorization Models: RBAC
● Role-Based Access Control (RBAC):
○ Access rights assigned based on predefined roles
○ Simplifies management, reduces complexity
● Advantages:
○ Efficient
○ Manageable
○ Reduces errors
● Limitations:
○ Less flexible when handling specific exceptions
● In what types of environments does RBAC work best?

31
Authorization Models: ABAC
● Attribute-Based Access Control (ABAC):
○ Uses dynamic policies based on attributes (user, environment, resource)
● Advantages:
○ Flexible
○ Granular control
● Challenges:
○ Difficulty of initial policy setup
○ Complex to manage
● Why might ABAC be more suitable for dynamic or complex environments
compared to RBAC?

32
 CSE298 Cybersecurity - Lecture 17
Identity and Access Management -
Governance, Privileged Accounts, and
Vulnerabilities
Spring 2025
Mark Erle
Password Entropy - Higher ∝ Strength/Unpredictability
● Password entropy is calculated using the formula: E = log2(R^L) or E = L × log2(R)
○ E is the password entropy in bits
○ R is the size of the character pool (possible unique characters)
○ L is the length of the password (number of characters)
● To calculate password entropy:
○ Determine the character pool size by adding up the sizes of all character sets
used:
○ Count the total number of characters in the password to get L; apply the formula!
● For example, a password using lowercase, uppercase, numbers, and symbols has:
○ R = 26 + 26 + 10 + 32 = 94 ⇐ typical U.S. keyboards have 32 symbols
○ L = 11
○ E = 11 × log2(94) ≈ 72 bits of entropy
● Generally, passwords with at least 64 bits of entropy are considered strong, requiring
approximately 2^64 (18 quintillion) guesses to crack.
34
Identity Governance and Lifecycle Management
● Framework for assigning and managing access rights throughout
employment.
● Managed collaboratively by IT, HR, and business units.
● Real-world methods:
○ Automated provisioning and de-provisioning (identity management
software)
○ Clearly documented policies and continuous monitoring of compliance
○ Regular access audits and reviews
● Why is collaboration between HR, IT, and managers essential for effective
identity governance?

35
Privileged Account Management
● Privileged accounts: Administrative or high-permission accounts (e.g., sysadmins,
database admins).
● Common realities:
○ Highly targeted by attackers due to elevated privileges
○ Often overlooked or improperly managed due to complexity or convenience
● Industry best practices:
○ Dedicated Privileged Access Management (PAM) solutions (e.g., CyberArk,
BeyondTrust)
○ Frequent password rotation and session recording
○ Just-in-Time (JIT) access: limiting elevated privileges only to necessary time
windows
● What are some common reasons privileged accounts are inadequately secured?

36
Password-Authenticated Key Exchange (PAKE) Protocols
● PAKE prevents actual password transmission over the network - not sent or stored!
● Server-side storage comparison:
○ Traditional: Username, salt, hashed password (vulnerable to offline attacks).
○ PAKE: Username, salt, cryptographic verifier (difficult to attack offline).
● Industry implications:
○ Superior protection against phishing, man-in-the-middle, and interception
attacks. How? Exercise left for the student.
○ Less vulnerable to offline brute-force attempts if databases are compromised.
○ Adoption growing due to increased security awareness (FIDO2/WebAuthn
standards).
● How does PAKE fundamentally change the way passwords are protected compared
to traditional methods?
37
Common IAM Vulnerabilities
● Real-world vulnerabilities:
○ Weak authentication policies (simple passwords, no MFA)
○ Poorly defined roles and excess privileges (privilege creep)
○ Unmanaged orphaned accounts (ex-employees retaining access)
○ Poorly implemented authentication mechanisms susceptible to brute
force, credential stuffing, or replay attacks.
● Practical realities:
○ Most breaches leverage simple and avoidable IAM mistakes.
○ Regular IAM hygiene and audits drastically reduce exposure.
● Which common IAM vulnerability is most frequently exploited by attackers in
recent breaches?

38
Exploits and Attack Vectors
● Common methods:
○ Credential stuffing (reusing credentials from data breaches)
○ Social engineering and phishing
○ Brute-force or password spraying attacks
○ Privilege escalation and lateral movement after initial compromise
● Real-world cases:
○ SolarWinds (2020): Initial compromise via IAM vulnerabilities leading to
severe, wide-reaching breach.
○ LinkedIn (2012): Weak hashing allowed easy compromise of millions of
passwords.
● Why do attackers frequently use credential stuffing and phishing as attack
vectors against IAM systems?

39
Effective IAM Threat Mitigation Strategies
● Strategic recommendations:
○ Adopt strong, cryptographic authentication mechanisms (e.g., MFA,
PAKE, passwordless solutions).
○ Regular IAM audits, compliance checks, and lifecycle management
processes.
○ Implementation of "Principle of Least Privilege" to limit damage from
breaches.
○ Ongoing security training programs focused on phishing awareness and
credential security.
● Industry tools:
○ Centralized IAM and Privileged Access Management (PAM) solutions.
○ Security Information and Event Management (SIEM) platforms for
continuous monitoring of IAM events.
● What IAM threat mitigation strategy would most effectively reduce credential
theft and misuse? 40
CSE298 Cybersecurity - Lecture 18
Introduction to Endpoint Security
Spring 2025
Mark Erle
What Are Passkeys? What Are Their Purpose?
● A passkey is a cryptographic credential used for authentication that replaces
traditional passwords.
● Passkeys and PAKE (Password-Authenticated Key Exchange) are related but
distinct authentication technologies.
○ Passkeys are not part of the PAKE protocol itself.
○ Passkeys are a newer authentication standard that rely on public key
cryptography rather than password-based authentication.
● Passkeys:
○ Are based on public-key cryptography: a private key stored securely on a
device and a public key registered with the service.
○ Eliminate the need for memorized secrets by relying on cryptographic keys.
○ Are resistant to phishing, password reuse, and brute-force attacks.
○ Offer a seamless, passwordless login experience.
42
How Do Passkeys Work? What’s the Process?
● Passkeys are service-specific, generated automatically by your device, and used to sign
authentication challenges.
● Individual Key Pair per Service:
○ When you create an account with a service that supports passkeys, your device
generates a unique key pair (a private key and a public key).
○ The private key is stored securely on your device (often in a secure enclave), while the
public key is sent to and stored by the service.
○ Note: You do not create one universal passkey to access all your accounts. Instead, each
service gets its own key pair, ensuring a compromise of one does not affect the others.
● Authentication Process:
○ When you log in, the service sends a challenge (a random piece of data) to your device.
○ Your device uses its private key to sign this challenge.
○ The signed challenge is sent to the service, which verifies it using the stored public key.
○ If the verification succeeds, you are authenticated.
43
Benefits of Passkeys Compared to Passwords
● Stronger Security:
○ No shared secrets; private key never leaves the device.
○ Resistant to phishing and offline brute-force attacks.
● Improved Usability:
○ Eliminates the need to remember complex passwords.
○ Simplifies authentication across devices.
● Reduced Administrative Overhead:
○ No need for periodic password resets.
● Passkey vs. Stored Passwords:
○ Passkeys are not used to unlock stored passwords. Rather, they replace
traditional passwords altogether by providing a secure way to prove your
identity without transmitting a secret over the network.
○ You don't provide the same passkey to multiple applications—instead,
each application/service has its own unique passkey pair. 44
Concerns, Issues, and Challenges with Passkeys
● Adoption and Compatibility:
○ Not all services or legacy systems support passkeys yet.
● Device Dependence:
○ Loss of device may complicate recovery if proper backup mechanisms
aren’t in place.
● User Education:
○ Users need to understand how passkeys work and what to do if they lose
their device.
● Interoperability:
○ Varying implementations across platforms might cause friction.
○ BUT, as long as each device is properly registered with the service, you
can authenticate from any of them without conflict. 45
What Endpoint Security Is
● Definition: Protection of devices (endpoints) connecting to a network.
● Scope: Laptops, smartphones, IoT, servers, POS systems.
● Key Challenge: Balancing usability vs. security.
● Why are endpoints considered the "frontline" of cyber defense?

46
Importance of Endpoint Security
● Stats: 350K+ new malware variants daily.
● Risks: Data leaks, ransomware, compliance penalties.
● Role in Zero Trust: "Never trust, always verify" applies to device authorization.
● How does remote work expand the attack surface?

47
Types of Endpoints

Endpoint Risk Profile

Laptops Phishing, unpatched OS

IoT Devices Default passwords, no encryption

Servers Privilege escalation, DDoS

● Which enpoint type is hardest to secure and why?

48
Common Vulnerabilities
● Outdated Software: Unpatched CVEs (e.g., Log4j).
● Weak Authentication: Default credentials on IoT
● Misconfigurations: Open ports, unnecessary services.
● Case Study: Mirai Botnet exploited default IoT passwords

49
Mirai Botnet
● The Mirai Botnet is a malware that exploits vulnerable Internet of Things (IoT) devices (e.g., routers, cameras,
DVRs) by hijacking them into a botnet for large-scale distributed denial-of-service (DDoS) attacks. Key details:
● Exploit Mechanism
○ Scanning: Mirai scans the internet for IoT devices using open Telnet ports (23, 2323) and a list of 60+
default username/password combinations (e.g., admin:admin)
○ Infection: Once a device is breached, Mirai replaces competing malware, blocks admin ports, and
connects it to a command-and-control (C&C) server
○ Botnet Activation: Infected devices ("bots") are directed to flood targets with traffic, overwhelming
services like DNS providers (e.g., the 2016 Dyn attack)
● Key Features
○ Persistence: Devices remain infected until rebooted but reinfected if default credentials aren’t changed
○ Evolving Variants: Post-source-code leak, variants like Satori, OMG, and gayfemboy emerged, exploiting
zero-days (e.g., CVE-2024-12856 in routers) and proxy setups
○ Impact: Enabled record-breaking DDoS attacks (e.g., 623 Gbps) and inspired ransomware schemes
● Mitigation
○ Change Default Credentials: Eliminate factory-set usernames/passwords
○ Patch Firmware: Address vulnerabilities like CVE-2023-26801 in routers.
○ Segment IoT Networks: Isolate devices to limit lateral movement
50
Exploits and Attack Vectors
● Malware: Ransomware (WannaCry), spyware.
● Credential Stuffing: Reusing breached passwords.
● Phishing: Social engineering via malicious links.
● Why is credential stuffing still effective today?

51
FREEDOM Administration
● Search in your browser for “FREEDOM Administration Login”
● Look for “[Link]” and click on it
● CVE-2025-26793, with vulnerability security score of 10 out of 10

52
CSE298 Cybersecurity - Lecture 19
Endpoint Risk Mitigation and
Advanced Topics
Spring 2025
Mark Erle
Endpoint Protection Platforms (EPP)
● Endpoint Protection Platforms (EPP)
○ EPP tools focus on preventing known threats using antivirus, firewalls, and intrusion prevention
systems (IPS).
○ Capabilities: Signature-based detection, heuristic analysis, and sandboxing for malware
prevention.
○ Limitations: Limited effectiveness against advanced persistent threats (APTs) or zero-day
exploits.
● Endpoint Detection and Response (EDR)
○ EDR tools provide real-time monitoring, threat hunting, and forensic analysis to detect and
respond to sophisticated attacks.
○ Capabilities: Behavioral analytics, automated response actions (e.g., quarantining infected
devices), and integration with Security Information and Event Management (SIEM).
○ Complementary Role: EDR works alongside EPP for comprehensive endpoint security.
● Encryption
○ Data at Rest: Use AES-256 encryption to secure sensitive files stored on endpoints.
○ Data in Transit: Implement TLS/SSL protocols to protect data during transmission.
○ Device-Level Encryption: Enable full-disk encryption on laptops and mobile devices to prevent
data theft if devices are lost or stolen. 54
Patch Management
● Automated Tools
○ Examples: Windows Server Update Services (WSUS), Ansible, System Center
Configuration Manager (SCCM).
○ Benefits: Reduces manual errors, ensures timely updates across all endpoints.
● Testing in Staging Environments
○ Before deploying patches organization-wide, test them in isolated environments
to avoid compatibility issues or system disruptions.
● Prioritization Using CVSS Scores
○ Use Common Vulnerability Scoring System (CVSS) scores to rank vulnerabilities
based on severity. Focus on patching critical vulnerabilities first.
● Regular Patch Cycles
○ Establish a routine schedule for patch deployment while remaining flexible for
urgent updates in response to zero-day vulnerabilities.
● Case Study Example
○ The 2017 Equifax breach occurred due to failure to patch a known vulnerability in
Apache Struts (CVE-2017-5638). This highlights the importance of timely patch
management. 55
Zero Trust and IoT Security
● Zero Trust Principles
○ Least Privilege Access: Ensure users and devices only have access necessary
for their roles.
○ Micro-Segmentation: Divide networks into smaller zones to limit lateral
movement during an attack.
○ Continuous Verification: Regularly re-authenticate users and devices instead of
relying on single-time verification.
● IoT Security Challenges
○ Limited computational power restricts encryption capabilities.
○ Default credentials make IoT devices easy targets.
○ Lack of firmware updates leaves vulnerabilities exposed.
● Solutions for IoT Security
○ Use hardware-based secure elements for cryptographic operations.
○ Implement network segmentation to isolate IoT devices from critical systems.
○ Monitor IoT traffic for anomalies using specialized security tools like
IoT-specific IDS/IPS systems.
56
● Should IoT devices be allowed unrestricted internet access? Why or why not?
Case Study - Colonial Pipeline Ransomware Attack (2021)
● Attack Overview
○ Initial Entry Point: Phishing email compromised credentials of a VPN account w/o MFA.
○ Malware Deployment: DarkSide ransomware encrypted key systems, disrupting pipeline
operations.
○ Impact: $4.4M ransom paid; $15M spent on recovery efforts; fuel shortages across U.S.
● Mitigation Failures
○ Lack of multi-factor authentication (MFA) for critical accounts.
○ Outdated backup systems delayed recovery.
○ Insufficient network segmentation allowed ransomware to spread across systems.
● Lessons Learned
○ Regularly test backup systems to ensure operational readiness during incidents.
○ Implement Zero Trust principles to prevent lateral movement within networks.
● What mitigation strategy could have prevented the Colonial Pipeline attack from escalating?
57
CSE298 Cybersecurity - Lecture 20
Understanding Social Engineering
Spring 2025
Mark Erle
What is Social Engineering?
● Definition
○ Exploiting human psychology rather than technology
○ Manipulating people into compromising security
● Relevance
○ Human error causes most cybersecurity breaches
○ Technical security alone is insufficient
● Technical vs. Human Vulnerabilities
○ Technical: vulnerabilities in software/hardware
○ Human: trust, curiosity, lack of awareness, authority, urgency
● Why is social engineering considered especially dangerous compared to
technical vulnerabilities?

59
Common Tactics: Phishing
● Phishing Overview
○ Fraudulent emails/messages designed to deceive recipients
● Variants
○ Email Phishing: Mass-distributed emails
○ Spear Phishing: Targeted at specific individuals or groups
○ Whaling: Targeting executives or high-profile personnel
● Indicators of Phishing
○ Urgency or threats
○ Unfamiliar sender addresses
○ Unexpected attachments or links
● What is the main difference between regular phishing and spear phishing?
60
Common Tactics: Pretexting
● Definition
○ Creating fabricated scenarios to gain trust and extract information
● Examples
○ Impersonating IT support to gain credentials
○ Fake job interviews to collect sensitive personal information
○ False authority figure requests
● Can you describe a situation where pretexting might be successfully used?

61
Common Tactics: Baiting
● Definition
○ Offering something enticing to lure victims into compromising security
● Examples
○ Free gift cards or coupons
○ Downloads promising free software, movies, or games that contain malware
● Give an example of a baiting attack. Why is it effective?

62
Common Tactics: Tailgating & Piggybacking
● Definition
○ Gaining unauthorized physical access by following authorized individuals
into secured areas
● Difference
○ Tailgating: Without permission, unnoticed
○ Piggybacking: Permission granted by authorized individual, often out of
politeness or pressure
● Risks
○ Physical access leading to data theft or sabotage
● What is the main difference between tailgating and piggybacking in physical
security?
63
Common Tactics: Quid Pro Quo Attacks
● Definition
○ Offering services or benefits in exchange for information or access
● Examples
○ Impersonating tech support offering "free assistance" in exchange for login
credentials
○ Fake surveys promising rewards for sensitive information
● How might a quid pro quo attack be conducted over the phone?

64
Common Tactics: Vishing and Smishing
● Definitions
○ Vishing: Voice-based phishing via telephone calls
○ Smishing: SMS-based phishing through text messages
● Examples
○ Fake automated calls from banks requesting PIN verification
○ Text messages urging recipients to click malicious links
● What makes vishing and smishing particularly effective methods for social
engineering?

65
Notable Exploit 1: Twitter Bitcoin Scam (2020)
● Overview
○ Attackers targeted Twitter employees to gain access to internal administrative tools
● Detailed Human Exploit
○ Attackers conducted targeted vishing calls posing as members of Twitter's IT security team
○ Pretended there was an urgent internal security issue, creating pressure and urgency
○ Successfully convinced employees to log in to a fake internal login portal, capturing their
credentials and multi-factor authentication tokens
● Attack Flow
1. Attackers collected employee contact details from LinkedIn and social media
2. Phoned targeted employees using credible internal jargon and information
3. Directed employees to enter their credentials into a phishing site disguised as a legitimate Twitter
internal system
4. Captured credentials and authentication tokens, gaining access to powerful administrative tools
● Impact
○ High-profile Twitter accounts (Obama, Musk, Gates, Bezos) used to execute a Bitcoin scam
○ Attackers stole over $100,000 in Bitcoin from followers who trusted these accounts
● What human vulnerability did attackers exploit in the Twitter Bitcoin Scam?
66
Notable Exploit 2: RSA Breach (2011)
● Overview
○ Sophisticated spear-phishing attack compromised RSA’s SecurID two-factor authentication product
● Detailed Human Exploit
○ Attackers sent carefully crafted emails titled "2011 Recruitment Plan" directly to RSA employees
○ Email appeared credible, using professional language, referencing familiar topics, and including a malicious
Excel attachment
○ Employees trusted the sender due to familiarity with internal company recruitment activities
○ Once opened, the malicious attachment installed a backdoor on RSA’s network
● Attack Flow
1. Employee received an email seemingly from an internal colleague referencing a legitimate company topic
2. Email included a malicious Excel attachment; curiosity and trust led the employee to open the file
3. Malware immediately established remote access to RSA’s network for the attackers
4. Attackers moved laterally within the network, ultimately stealing sensitive cryptographic seed information for
RSA SecurID tokens
● Impact
○ RSA was forced to replace millions of compromised tokens for thousands of enterprise clients
○ Long-term reputational damage and financial loss
● What specific tactic led to RSA’s compromise?
67
Notable Exploit 3: Uber Breach (2022)
● Overview
○ Social engineering attack enabled full internal network access at Uber
● Detailed Human Exploit
○ Attacker initially gained employee login credentials through a phishing attack
○ When confronted with multi-factor authentication (MFA), the attacker targeted an employee directly via Slack
messages
○ Attacker impersonated an internal IT administrator, stating they urgently needed help troubleshooting MFA
issues
○ Convinced the employee to accept the MFA request, granting attacker direct access
● Attack Flow
1. Employee credentials initially compromised through phishing
2. MFA blocked immediate attacker access
3. Attacker contacted employee directly through internal Slack channel, posing convincingly as IT personnel needing
assistance
4. Employee, trusting the internal identity and pressured by urgency, approved MFA request granting attacker access
● Impact
○ Exposure of sensitive internal systems, including internal Slack messages, security tools, cloud infrastructure,
and source code repositories
○ Significant reputational damage and loss of customer trust
68
● How was multi-factor authentication bypassed during the Uber breach?
Scenario 1: Email from “IT Support”
● Email Content:
Subject: Urgent: Account Security Notice
From: IT-support@[Link]
Dear User,
Due to recent suspicious activity detected on your university account, immediate
password verification is required.
[Click Here to Verify Your Account]
Failure to act within 24 hours will result in account suspension.
Thank you,
IT Security Team
● Comment on tactic and indicators of malicious intent 69
Scenario 2: Phone Call Scenario (Transcript)
● Caller:

"Hi, this is Margaret from Microsoft Technical Support. We’ve noticed your
computer is reporting several critical security errors. I can assist you right
now to fix it. Could you please provide remote access so we can resolve
this before your computer is accessed by a threat actor?"

● Comment on tactic and indicators of malicious intent

70
Scenario 3: USB Stick Found in a Campus Parking Lot
● Situation:

You find a USB labeled "Confidential Staff Salaries [Link]" lying near
your car in the campus parking lot.

● Comment on tactic and indicators of malicious intent

71
CSE298 Cybersecurity - Lecture 21
Combating Social Engineering and
Building Cybersecurity Culture
Spring 2025
Mark Erle
Questions Based on Last Lecture
● Common tactics covered: phishing, pretexting, baiting, tailgating, quid pro
quo, vishing, smishing
● Why do attackers often find social engineering attacks more effective than
purely technical exploits?
● Consider the Twitter Bitcoin scam from 2020 discussed in the last lecture.
What specific human traits or behaviors were targeted, and how could
employees have responded differently?
● Suppose you find an unlabeled USB stick near a campus computer lab. What
should your response be, and why?

73
Prevention and Mitigation Strategies
● Technical Controls
○ Email filtering and detection tools
○ Multi-factor authentication (MFA)
● Policies & Procedures
○ Verification and authorization requirements
○ Clear reporting mechanisms
● Continuous Monitoring
○ Real-time detection systems (EDR, SIEM integration)
○ Incident response readiness

74
Security Awareness Training
● Goals
○ Reduce human vulnerability through education
○ Foster proactive security behaviors
● Components of Effective Training
○ Interactive content and engagement
○ Simulated campaigns
○ Regular training refreshers
○ Role-based training tailored to job functions
● Evaluating Effectiveness
○ Metrics: reduced incidents, improved reporting rates, participation levels
● What are two key reasons why organizations need both technical and
human-focused strategies to combat social engineering attacks?

75
Building a Culture of Cybersecurity Vigilance
● Importance of Culture
○ Human element as first and last line of defense
○ Long-term behavior change reduces risk
● Leadership’s Role
○ Demonstrating commitment to security
○ Empowering employees to act securely
● Encouraging Reporting
○ Non-punitive reporting culture
○ Recognition for proactive behavior

76
Follow-up on Building a Culture of Cybersecurity Vigilance
● How does a positive cybersecurity culture impact employee behavior in the
context of security?
● Give an example of how security awareness training can be evaluated
effectively.

77
Social Engineering Training Exercise (slide 1 of 2)
1. Planning and Conception
● Define clear objectives (e.g., assess vulnerability to phishing)
● Identify target audience (departments, roles, etc.)
● Select relevant tactics to simulate (phishing, vishing, pretexting)
2. Exercise Design
● Develop realistic scenarios (email campaigns, phone scripts)
● Create believable content reflecting common attacks
● Set technical infrastructure (e.g., simulated phishing platforms)
3. Pre-Exercise Communication
● Notify leadership and IT/security stakeholders
● Decide if employees receive advance notice or remain unaware
● Establish clear guidelines and policies to handle sensitive outcomes 78
Social Engineering Training Exercise (slide 2 of 2)
4. Execution
● Conduct the simulated attack campaign over a defined period
● Monitor employee interactions in real-time
● Record response metrics (click rates, credential submissions, reporting)
5. Data Collection and Analysis
● Compile and analyze collected data against objectives
● Identify patterns, weaknesses, and strengths
● Evaluate overall effectiveness of existing security measures
6. Feedback and Reporting
● Share anonymized findings transparently with staff
● Provide targeted education based on identified weaknesses
● Recommend and implement improvements for future exercises 79
CSE298 Cybersecurity - Lecture 22
Incident Response & Monitoring
Spring 2025
Mark Erle
Security Failings in the UK Government’s One Login
Digital ID System
● Recent investigation revealed serious cybersecurity and data protection shortcomings in UK Government’s flagship digital
identity system, One Login - used to access various government services.
● According to whistleblower reports and subsequent correspondence from the National Cyber Security Centre (NCSC), the
system suffered from:
○ Insufficient security personnel and governance: The digital identity team lacked enough qualified staff to provide
effective cybersecurity oversight.
○ Lack of risk assessment and documentation: No comprehensive risk or threat assessments were conducted, and
there was no evidence that security requirements had been properly identified or managed.
○ Inadequate security monitoring: There were gaps in monitoring for indicators of compromise and privileged access,
increasing the risk of undetected breaches.
○ Non-compliant system administration: Administrators accessed the live production environment using non-compliant
devices, raising the risk of malware or phishing attacks.
○ High volume of unresolved vulnerabilities: Over half a million vulnerabilities were identified in the live system,
including more than 10,000 critical and 7,000 high-severity issues.
○ Concerns over personnel security clearance: Nearly 40% of production administrators lacked the appropriate security
clearance, despite handling sensitive citizen data.
○ Potential conflicts of interest in assurance processes: The same consultancy involved in developing the system was
also responsible for its security assurance, raising questions about the independence of risk assessments.
● The NCSC concluded the system had “severe shortcomings” and “top-level risks,” including the potential for bulk personal
data breaches and mass fraud through impersonation.
81
Accenture and Google Launch AI-Powered Security
Operations for Government
● On April 8, 2025, Accenture Federal Services announced a new partnership with Google
Public Sector to launch a Managed Extended Detection and Response (MxDR) solution
specifically for government agencies
● This new offering integrates Google’s Security Operations (SecOps) platform with
Accenture’s federal cybersecurity expertise and leverages security-specific generative AI
technology to enhance threat detection and response capabilities.
● Key features of the solution include:
○ Real-time, intelligence-based threat detection using advanced AI and machine
learning.
○ Automated response playbooks to streamline and modernize incident response.
○ Customizable dashboards tailored for federal use cases.
○ 24/7 support and compliance with federal cybersecurity controls.
● The collaboration aims to help federal agencies improve their cybersecurity resilience,
streamline security operations, and reduce costs.
82
Introduction to Security Operations
● Functions:
○ Developing operational policies and enforcing them (governance)
○ Preparing for, detecting, responding to, and recovering from
cybersecurity incidents
● Importance:
○ Real-time threat detection
○ Minimizing damage from incidents
○ Ensuring regulatory compliance
● Why is timely incident response critical for organizations?

83
Incident Response Lifecycle
1. Preparation – Building a capable response team and clear policies
2. Identification – Detecting and confirming incidents
3. Containment – Limiting damage and isolating the threat
4. Eradication – Removing threats and restoring affected systems
5. Recovery – Returning to normal operations securely
6. Lessons Learned – Reviewing and improving incident response strategies

Which phase do you think is most challenging for organizations, and why?

84
Incident Response Team
● Roles and Responsibilities:
○ Team Leader
○ Incident Analysts
○ IT Support
○ Public Relations
○ Legal Advisors
● Why is cross-departmental coordination essential in incident response?

85
Security Monitoring and Logging
● Importance of logs:
○ Provide audit trails
○ Enable incident detection
○ Support regulatory compliance
● Types of logs:
○ Event logs
○ Access logs
○ Application logs
● How can logging facilitate incident response?

86
Security Information and Event Management (SIEM)
● Definition: Integrated tool for collecting, analyzing, and managing security data
● Core functionalities:
○ Real-time monitoring
○ Threat detection and correlation
○ Incident response support
○ Reporting and compliance
● What advantages does a SIEM provide compared to manual log analysis?

87
Example SIEM Tools
● Splunk
● QRadar
● LogRhythm
● Wazuh (open source!)
● What factors should an organization consider when selecting a SIEM tool?

88
“The Case of the Stolen Intellectual Property”
● Scenario: A tech startup, InnoSoft, suspects an employee leaked proprietary
AI algorithms to a competitor. The incident was flagged when a rival company
filed a patent suspiciously similar to InnoSoft’s unpublished work.
● Questions
○ What evidence might you be searching for?
○ How open or covert should your investigation be?
○ What tools could you use? What if exfiltrated data were encrypted?
○ What care needs to be taken with regard to evidence?
○ If you identify a suspect, what steps should you take and when?
○ What should you communicate to stakeholders and when?

89
CSE298 Cybersecurity - Lecture 23
Forensics, Investigation, and
Continuous Monitoring
Spring 2025
Mark Erle
CyberSentinel: AI-Driven Threat Detection

● The emergence of AI in cybersecurity has led to the development of systems

like CyberSentinel, which utilizes machine learning for real-time threat
detection.
● By analyzing SSH logs and assessing phishing threats, CyberSentinel
represents a shift towards proactive and adaptive security measures,
highlighting the integration of AI in continuous monitoring strategies.

91
UK's Cyber Security and Resilience Bill

● The UK government has proposed the Cyber Security and Resilience Bill to
strengthen national cyber defenses.
● The legislation aims to enhance incident reporting requirements, enforce
stringent cybersecurity measures across various sectors, and improve
oversight of critical infrastructure.
● This move reflects the global trend towards regulatory frameworks that
prioritize continuous monitoring and rapid incident response.

92
Digital Forensics Overview
● What is Digital Forensics?
○ Process of collecting, analyzing, preserving, and presenting digital
evidence
○ Critical in understanding incidents, prosecuting cybercrimes, and
informing security improvements
● Importance in Security Operations
○ Incident validation and reconstruction
○ Support legal and compliance requirements
○ Provide insights for future threat prevention
● Why is maintaining the integrity of digital evidence crucial?

93
Forensic Investigation Process
● Steps of Digital Forensics
○ Identification: Determining potential evidence sources
○ Preservation: Ensuring evidence integrity
○ Collection: Systematic extraction of evidence
○ Examination: Inspecting collected data
○ Analysis: Deriving insights and conclusions
○ Reporting: Documenting and presenting findings
● Which forensic step might introduce the most significant risks if mishandled,
and why?

94
Chain of Custody
● Definition and Purpose
○ Documentation trail that records handling of evidence
○ Ensures authenticity, credibility, and admissibility in court
● Chain of Custody Essentials
○ Who handled the evidence
○ Date and time of handling
○ Actions performed on evidence
○ Secure storage conditions
● What consequences could result from a compromised chain of custody?

95
Common Forensic Tools
● Disk Imaging & Analysis: EnCase, FTK Imager, Autopsy
● Network Analysis: Wireshark, tcpdump, Zeek
● Memory Forensics: Volatility Framework
● Log Analysis: Splunk, ELK stack
● How do forensic analysts decide which tool to use?

96
Continuous Monitoring
● Definition and Purpose
○ Real-time tracking of security posture
○ Identifies threats promptly, reducing response time and impact
● Components of Effective Monitoring
○ Endpoint detection and response (EDR)
○ Network intrusion detection systems (IDS)
○ Log aggregation and SIEM integration
● How does continuous monitoring enhance the effectiveness of incident
response teams?

97
Patch Management: Overview
● Definition and purpose
○ Systematic approach to managing software updates and vulnerability
remediation
○ Critical for reducing exposure to known threats
● Patch Management Goals
○ Minimize vulnerability exposure
○ Maintain system and data integrity
○ Ensure compliance and operational continuity
● Why is proactive patch management crucial for cybersecurity?

98
Sources of Patch Information
● Common Sources:
○ Vendor advisories and security bulletins (e.g., Microsoft Security Bulletins,
Adobe Security Updates)
○ Vulnerability databases (e.g., National Vulnerability Database - NVD, CVE
databases)
○ CERT Coordination Center (US-CERT), industry-specific threat intelligence
feeds
● Where should organizations primarily obtain timely and credible patch
information?

99
Patch Testing and Validation
● Testing Considerations
○ Compatibility with existing software and infrastructure
○ Functionality impact and regression issues
○ Stability under production-like conditions
● Validation Steps
○ Create a controlled testing environment
○ Deploy patches to representative systems first
○ Monitor closely for unexpected behavior or conflicts
● Why is thorough patch testing critical before enterprise-wide deployment?

100
Communication and Coordination
● Requirements for Success
○ Clearly defined roles and responsibilities for patch management team
○ Effective notification channels (emails, intranet updates, meetings)
○ Coordination with departments to minimize disruptions during deployment
● Best Practices
○ Schedule patches during maintenance windows
○ Communicate clearly about timing, expected downtime, and potential
impacts
● How does clear communication improve the effectiveness of patch
management?

101
Tracking and Reporting Patch Status
● Tracking Techniques
○ Automated patch management solutions (e.g., SCCM, WSUS, Ivanti,
ManageEngine)
○ Dashboards and centralized reporting tools
● Reporting Essentials
○ Compliance rates
○ Systems pending patch application
○ Documenting exceptions or failures
● What benefits does centralized patch tracking provide to security management?

102
CSE298 Cybersecurity - Lecture 24
Security Assessment and Testing
Penetration Testing & Discovery

Spring 2025
Alex Clevenger
Security assessment as a principle
● What is security assessment?
● Why does it matter?
● Is there a difference between the following terms:
○ Assessment, Testing, and Continuous verification
● Assessment: evaluate the overall posture of a system, process, or
organization.
● Testing: To validate specific behaviors or outputs against expected results
● Cont. Verification: To automatically and repeatedly confirm that systems
behave securely and correctly over time.
104
How security professionals assess
● Credentialed vs. non-credentialed scans
● Common tools used:
○ Nessus
○ OpenVas
○ Tool + tuning for false positives

Question: Are these tools knowledge-based or behavior-based?

● CVSS scoring basics

105
CVSS ext.

106
Phases
● Recon → Exploit → Post‑exploit → Cleanup
● Two types of reconnaissance:
○ Passive reconnaissance: Collect information without directly targeting
the endpoint
○ Active reconnaissance: Collect information by directly targeting the
endpoint
● Exploit
○ Establish C2C channel (resource considerations)
○ Data infiltration
○ In-memory execution

107
Phases cont.
● Post-exploit
○ Credential dumping or corruption
■ Depending on the goal
○ Data exfiltration
○ Lateral movement
○ Persistence
● Cleanup
○ Log clearing
○ Remove any writes to disk in general
○ Remove persistence
○ Terminate and close C2C channel

108
PTES/OWASP Testing Guide
● Penetration Testing Execution Standard (PTES):
○ A structured, methodology-driven framework
○ Well defined phases for pentesting professionals to follow
● Open Worldwide Application Security Project (OWASP) testing guide:
○ Web application-specific framework for pen-testing
● Why do pentesters use guides like PTES and OWASP?

109
Ethics, scoping & rules of engagement
● Critically important to define scope ahead of time
○ Legal protection
● Informed consent is non-negotiable
● Company does not wanting 3rd party snooping where they shouldn’t be
● Possible to break mission critical systems
○ Hospital
● Report responsibly

110
Mitre Att&ck
● Mitre is non-profit organization that provides sophisticated frameworks for
security assessment
● Categories list of common tactics, techniques, and procedures
● Uses historical data to define attack vectors and nefarious behavior
● Not just a list of CVEs
○ A curated list of HOW previous hackers have exploited systems
● Mitre Defense is the blue-team counterpart

Where does this fit into the context of security assessment?

111
SAST, DAST, and IAST
● SAST (static): Static Application Security Testing
○ Analyze source code or bytecode without executing
● DAST (dynamic): Dynamic Application Security Testing
○ Running the application as a black-box
● IAST: Interactive Application Security Testing
○ Combines elements of both

What are some of the tradeoffs between these different approaches?

112
OWASP Top 10 overview
● A standard awareness document for developers and security professionals
● Sets standard for top 10 most critical security risks for web-apps specifically
● Updated periodically by the OWASP Foundation
● Not simply a list of bugs
○ Architectural flaws and common insecure practices
● Vast majority of CVE’s fall into these categories
○ Discovery mechanisms use this to identify patterns

113
Dependency scanning
● Looking at the dependencies in your application
○ ‘-H’ compiler flag
● Scanning specifically for known CVE’s in your third party code
● Open source tools
○ Npm, maven, pip
● System libraries
○ OpenSSL, Glib, libc

Common tools: Snyk, Dependabot

114
CSE298 Cybersecurity - Lecture 25
Security Assessment and Testing
Analyzing, Reporting, Automating

Spring 2025
Alex Clevenger
Network mapping (Nmap, masscan)
● Goal: discover and interpret the layout of a given system
● Use the right tool: breadth vs depth
● Know how to interpret the output meaningfully
● Use built-in output formats (-oX, -oG, -oN) to save and document scan results
● Automate scanning and analysis workflow
○ Cron
○ Pipelines
● Address the drawbacks of your workflow

116
Firewall rule testing & bypass techniques
● Firewall overview
○ Stateful vs. Stateless
○ Rule-based “gatekeepers”
○ Top-down evaluation and chaining
○ Default-deny and default-allow strategies
● Testing
○ Simulate various traffic types
○ hping3, nmap, curl, telnet, netcat
○ Look for holes

117
Firewall Bypass Techniques
● Tunneling: wrap the traffic inside protocols that the firewall allows
● Port knocking: Use a specific sequence of connections to try to trigger rule
changes in the firewall
● Source spoofing: test how the firewall responds to spoofed traffic
● Payload obfuscation: determine whether the firewall is inspecting the packet
payloads or just the headers
● Document findings
○ E.g. “Firewall allows telnet from X.X.X.X/y”
● Automate bypassing strategies

118
Wireless basics
● Wifi security protocols
○ WPA2 or WPA3 (Both enterprise & personal)
● WPA2
○ 4-way handshake, AES-CCMP encryption
● WPA3
○ SAE (Dragonfly), AES-CCMP encryption
● Wireless enumeration (airmon-ng, airodump-ng, kismet, or Wireshark)
○ Discover nearby SSIDs
○ Capture handshakes for WPA cracking
○ Monitor channel usage
● Rogue APs and Evil Twin
119
Wifi sniffing
● Switched vs. Non-switched traffic
○ Non-switched (e.g Hub)
■ All frames are sent to every port
○ Switched (e.g. Switch)
■ Learns MAC address per port and only forwards frames to that dest
● Promiscuous mode
○ NIC processes ALL ethernet frames it sees, not just those addressed to
its MAC address
○ Newer encryption standards enforce client isolation
● Monitor mode
○ NIC captures all raw 802.11 frames on a given channel
■ Beacons, probe requests, handshakes, etc

120
Wireless Segmentation
● VLAN: Virtual Local Area Network
○ VLAN tagging with VLAN ID
○ Switches use this tag to determine where the packet belongs
● Each VLAN is treated like its own network
○ Broadcasts, multicasts, unicast traffic stay isolated
● VLAN and RBAC
● Test and automate segmentation effectiveness

Question: Why does segmentation matter? Why go to the effort?

121
Frameworks
● MITRE ATT&CK for technique mapping
● NIST CSF: broad risk management lifecycle
○ Identify, Protext, Detect, Respond, Recover
● Kill chain (Lockheed Martin)
○ Sequence of attacker actions from recon to exfiltration
● Interpret and use threat intelligence
○ Key indicators: IPs, hashes, domains, file names, behavioral patterns
○ Learn how to correlate intel with observed behavior

122
Threat Intelligence
● Strategic Intel: high-level trends
● Tactical Intel: IOCs, attacker tools
● Operational Intel: active campaigns
● Technical Intel: raw data like exploit code

● Structured threat reporting

● Automation of intel ingestion and detection
● Adversarial modeling

123
Structuring executive vs. technical reports
● Executive reporting
○ High-level
○ Non-technical crowd
○ Risk-focused summaries and business impact
● Technical reporting
○ Precise language
■ Tools versions, commands
○ Steps to reproduce
■ Logs, payloads, screenshots
○ Severity (CVSS)
○ Remediation instructions

124
Ticketing systems (Jira/ServiceNow)
● What is the purpose of ticketing systems?
○ Centralize issue tracking: incidents, bugs, vulnerabilities
● Basic fields
○ Summary, Description, Severity/Priority, Labels, Status, Assignee, Due
Date
● Lifecycle
○ Open → In Progress → Resolved → Closed
● Automation
○ Tickets can be auto-generated from scans

125
Retest planning
● Once a ticket has been “resolved” → Verify, Validate, Document
● Not simply a “re-running a scan”
○ Verifying the effectiveness of the fix
● Ensures vulnerabilities are not reintroduced or misconfigured after patching
● Prepare a clear-cut retest strategy
○ Who executes it? What will it affect? How will it happen?
● Document the outcome
● Automate where appropriate
○ CI/CD pipeline

126
DevSecOps
● What is it?
○ Embedding security into EVERY phase of SDLC
● Philosophy
○ Security is everyone’s responsibility
○ Security flaws should be addressed earlier rather than later in the
SDLC
○ Combine different roles for collaborative risk management
● Tools and testing types
○ SAST, DAST, IAST

127
Continuous Testing
● Fundamentally integrate security into CI/CD pipelines
○ Github Actions, Gitlab CI, CircleCI, etc
● Set clear thresholds for failure
○ Under what conditions should the build or push fail?
● Security testing should be automated at:
○ Code commit
○ Build
○ Pre-deployment
○ Post-deployment

128
Continuous Testing cont.
● Automated findings should be pushed to appropriate location
○ Dashboards, ticketing systems
● Measure and improve
○ Track security metrics over time w.r.t. the CI/CD pipeline
● Automate remediation when appropriate
○ Under certain circumstances, tools can be used to “auto-patch”
○ Pre-configure secure templates

Question: Are there dangers with automating remediation?

129
 CSE298 Cybersecurity - Lecture 26
Security Architecture and Engineering
- Design Principles and Models
Spring 2025
Mark Erle
Security Architecture and Engineering
● What is it?
○ Designing, building, and maintaining secure systems by applying structured
principles, models, and technologies to minimize risk and resist attacks
● Key Components
○ Architecture - High-level system design that defines trust boundaries, data
flows, access controls, and component interactions
○ Engineering - Implementation and integration of technologies (hardware,
software, cryptography) that enforce security requirements at every level
● Focus areas include:
○ Secure design principles
○ Security models
○ Integration of cryptographic mechanisms
○ Hardware and software protections
131
Importance of Security Architecture and Engineering
● Why it matters
○ Security architecture connects principles, models, and technologies into
cohesive system designs
○ Poor architecture decisions can undermine even the strongest
cryptography or policies
○ This domain addresses how we engineer secure systems that resist
real-world threats
○ It represents the capstone of what we've studied: applying layered
security thinking to complete system design
● Think about a system you trust/use (e.g., phone, cloud storage, banking app).
○ What architectural decisions might make you trust—or distrust—it?

132
Secure System Design Principles - 1 of 2
● Defense in Depth
○ Layered security mechanisms: physical, technical, administrative
○ Redundancy across security controls to reduce single points of failure
○ Examples: firewall + endpoint security + user training
● Least Privilege
○ Each process/user should operate using the minimal level of access
○ Reduces impact of exploitation or error
○ Supports containment and forensic traceability
● How do these principles relate to software you've used or built?

133
Secure System Design Principles - 2 of 2
● Separation of Duties
○ Avoids concentration of power or control in a single entity
○ Enforces accountability through task distribution
● Fail-Safe Defaults
○ Deny access by default; require explicit permission
○ Ensures predictable behavior under failure
● Economy of Mechanism
○ Simpler systems are easier to verify and secure
○ Minimal complexity reduces attack surface
● How do these principles relate to software you've used or built?

134
Bell-LaPadula (BLP) Model – Confidentiality-Focused
● Goal: To prevent unauthorized disclosure of information in systems that manage data at
different sensitivity levels (e.g., Top Secret, Secret, Confidential, Unclassified).
● Rules:
1. Simple Security Property ("No Read Up")
A subject (e.g., a user or process) cannot read data at a higher classification than their
own.
→ Prevents access to more sensitive information.
2. Star Property ("No Write Down")
A subject cannot write data to a lower classification level.
→ Prevents leaking sensitive data to less secure areas.
● Example Use: A military document system
○ A user cleared for Secret can:
■ Read Secret and Confidential files
■ Cannot read Top Secret files (No Read Up)
■ Cannot write to Confidential or Unclassified (No Write Down)
● Use in Architecture:
○ Implemented in access control policies for classified systems
○ Applies to file permissions, databases, and cloud tiering 135
Biba Model – Integrity-Focused
● Goal: To prevent unauthorized modification of data. Used when data accuracy and
trustworthiness are paramount (e.g., medical records, financial systems).
● Rules:
1. Simple Integrity Property ("No Read Down")
A subject cannot read data at a lower integrity level.
→ Avoids contamination by untrusted sources.
2. Star Property ("No Write Up")
A subject cannot write to a higher integrity level.
→ Prevents less trusted entities from corrupting more trusted data.
● Example Use: A financial system
○ A junior employee (low integrity level) can:
■ Read their own input data
■ Can read audited, high-integrity data (Reading Up allowed)
■ Cannot overwrite trusted financial reports (No Write Up)
● Use in Architecture:
○ Controls what apps or users can modify sensitive databases or logs
○ Often combined with audit trails and trusted paths 136
Clark-Wilson Model – Transaction Integrity
● Goal: To prevent unauthorized modification of data; used when data accuracy and
trustworthiness are paramount (e.g., medical records, financial systems).
● Key Concepts
○ Well-formed transactions: All data changes must occur through controlled, logged
processes
○ Separation of duties: Different roles are required to initiate, approve, and verify actions
● Example Use: In accounting
○ One user inputs an expense (can’t approve it)
○ Another user reviews and approves (can’t alter it)
○ System logs every action through controlled interfaces
● Use in Architecture:
○ Role-based access controls
○ Enforced workflows (e.g., ERP or banking systems)

137
How Are These Models Used in Practice?
● You don't directly code "Bell-LaPadula rules", but you apply the logic through:
○ Access control mechanisms (ACLs, RBAC)
○ Labeling systems (e.g., SELinux, MAC policies)
○ Security policy engines (like AppArmor or security middleware)
● In secure system architecture:
○ BLP protects secrecy
○ Biba protects data integrity
○ Clark-Wilson ensures business logic and oversight
● They inform policy decisions… Who should be allowed to access what and
under what conditions?

138