Real-world vulnerabilities

Students must be able to identify vulnerabilities exploited in a real-world case which led to a security breach/failure and identify the category of the vulnerability (system-based, practice/administrative-based, human-based).[edit]

To be able to identify vulnerabilities exploited in a real-world case and classify them according to their category, students should have a strong understanding of the different types of vulnerabilities that can exist in computer systems and how they can be exploited by attackers. They should also be familiar with the different categories of vulnerabilities and how to identify them based on their characteristics and root causes.

There are three main categories of vulnerabilities: system-based, practice/administrative-based, and human-based.

System-based vulnerabilities are vulnerabilities that exist in the hardware or software of a computer system, such as vulnerabilities in the operating system, application software, or network protocols. These vulnerabilities can be exploited by attackers to gain unauthorized access to the system or to perform other malicious actions.
Practice/administrative-based vulnerabilities are vulnerabilities that exist due to poor practices or inadequate policies and procedures in an organization. These vulnerabilities can include things like weak passwords, lack of security awareness training, or inadequate security controls. These vulnerabilities can be exploited by attackers to gain unauthorized access to the system or to perform other malicious actions.
Human-based vulnerabilities are vulnerabilities that exist due to the actions or behaviors of individuals within an organization. These vulnerabilities can include things like social engineering attacks (e.g., phishing, baiting) or physical security breaches (e.g., lost or stolen devices). These vulnerabilities can be exploited by attackers to gain unauthorized access to the system or to perform other malicious actions.

To identify vulnerabilities exploited in a real-world case, students might consider the following steps:

Gather information about the security breach or failure, including details about how the attack was carried out and what types of data or resources were compromised.
Analyze the information to identify the specific vulnerabilities that were exploited by the attacker. This may involve looking for clues in the method of attack or the types of data or resources that were compromised.
Classify the vulnerabilities according to their category. This may involve considering the root cause of the vulnerability and how it fits into one of the three categories (system-based, practice/administrative-based, human-based).
Document the vulnerabilities and their classification, along with any other relevant information about the security breach or failure. This may include information such as the impact of the breach or failure, the steps taken to mitigate the vulnerabilities, and any recommendations for improving security in the future.

Overall, the ability to identify vulnerabilities exploited in a real-world case and classify them according to their category is an important skill for computer science students, as it enables them to understand the root causes of security breaches and failures and to identify and address vulnerabilities in order to improve the security of their systems and networks.

Students must be able to explain the responsibility of an organisation (ethically and legally) to deploy a security policy, outline the characteristics of a robust security strategy, and identify countermeasures to prevent a future security breach/failure.[edit]

Organizations have a responsibility, both ethically and legally, to deploy a security policy in order to protect their assets (such as data, systems, and networks) and to maintain the trust of their stakeholders (such as employees, customers, and shareholders). This responsibility may be defined by laws, regulations, and industry standards that apply to the organization, as well as by the organization's own policies and procedures.

To fulfill this responsibility, organizations should develop and implement a robust security strategy that includes a set of measures and controls to protect against potential security threats and vulnerabilities. A robust security strategy should have the following characteristics:

It should be comprehensive, covering all aspects of the organization's assets and operations that are at risk of a security breach or failure.
It should be flexible, able to adapt to changing security threats and vulnerabilities over time.
It should be scalable, able to accommodate the organization's growth and changing needs.
It should be aligned with the organization's business objectives and priorities.
It should be cost-effective, balancing the need for security with the organization's budget and resources.

To prevent a future security breach or failure, organizations should also identify and implement appropriate countermeasures to address identified vulnerabilities and threats. These countermeasures may include technical controls (such as firewalls, encryption, and authentication systems), administrative controls (such as policies, procedures, and training programs), and physical controls (such as access controls, security guards, and security cameras).

Overall, the ability to explain the responsibility of an organization to deploy a security policy and to identify countermeasures to prevent a future security breach or failure is an important skill for computer science students, as it enables them to understand the importance of security in protecting the assets and interests of an organization.

Students must be able to explain the need for organisations to analyse attacks conducted on others to identify risks to their own systems.[edit]

It is important for organizations to analyze attacks conducted on others in order to identify risks to their own systems, as this can help them to better understand the types of threats and vulnerabilities that they may be facing and to develop appropriate countermeasures to protect against these risks.

There are several reasons why organizations should analyze attacks conducted on others:

To identify trends and patterns in the types of attacks that are being conducted. By analyzing attacks conducted on others, organizations can get a sense of the tactics, techniques, and procedures (TTPs) that attackers are using and the types of systems and data that they are targeting. This information can help organizations to better understand the risks that they may be facing and to develop more effective countermeasures.
To learn from the experiences of others. By analyzing attacks conducted on others, organizations can learn from the successes and failures of other organizations and apply this knowledge to their own security practices.
To identify vulnerabilities in their own systems. By analyzing attacks conducted on others, organizations can identify vulnerabilities in their own systems that may be similar to those that were exploited in the attacks on other organizations. This can help organizations to prioritize their security efforts and to address vulnerabilities before they are exploited by attackers.

Overall, the ability to explain the need for organizations to analyze attacks conducted on others to identify risks to their own systems is an important skill for computer science students, as it enables them to understand the importance of staying informed about the evolving threat landscape and to take proactive steps to protect their systems and data.

Students must be able to describe the purpose and process in “Red Teaming” and identify the advantages of simulating security attacks for an organisation.[edit]

organization's systems and defenses in order to identify weaknesses and vulnerabilities. It is typically conducted by a team of security experts who are skilled in identifying and exploiting vulnerabilities, and who use a variety of tactics, techniques, and procedures (TTPs) to simulate attacks on the organization's systems and defenses.

The purpose of "Red Teaming" is to identify weaknesses and vulnerabilities in an organization's security posture that may not be apparent through other types of testing or assessment. By simulating attacks from the perspective of an attacker, "Red Teaming" can help organizations to identify and prioritize areas for improvement in their security posture and to develop and implement more effective countermeasures.

The process of "Red Teaming" typically involves the following steps:

Define the scope and objectives of the assessment. This may involve identifying specific systems, networks, or applications that will be tested, as well as the types of attacks that will be simulated.
Identify the team members who will conduct the assessment. This may involve selecting a team of security experts with the necessary skills and experience to conduct the assessment.
Plan the assessment. This may involve developing a detailed plan for the assessment, including the tactics, techniques, and procedures (TTPs) that will be used to simulate attacks on the organization's systems and defenses.
Conduct the assessment. This may involve simulating attacks on the organization's systems and defenses using the TTPs identified in the assessment plan.
Analyze the results of the assessment. This may involve reviewing the findings of the assessment and identifying areas for improvement in the organization's security posture.
Report the results of the assessment. This may involve preparing a report that summarizes the findings of the assessment and recommends actions that the organization can take to improve its security posture.