A game account gone overnight
Sam plays an online game every evening. One morning the account will not open. The password has been changed and the rare items have gone.
Somebody wanted those items. Somebody else might have wanted the money, or just the fun of it. Knowing who attacks, and why, is where defending starts.
The one rule
Warning
Only test your own copy of a lab, and only with permission. Your lab is private and cannot reach anybody else. We learn how attacks work so we can defend against them. Trying them on a system that is not yours is a crime under the Computer Misuse Act 1990.
By the end of this lesson
Note
I can name the threats to a system and who is behind them.
Key words
| Word | What it means |
|---|---|
| Asset | something worth protecting, such as data or a service |
| Threat | something that could harm an asset |
| Attacker | a person or group who tries to cause the harm |
| Confidentiality | only the right people can read the data |
| Integrity | the data has not been changed without permission |
| Availability | the service works when people need it |
The cells students fill in are left blank in this preview.
Three things every system must keep
Security people check three things about every asset. Confidentiality: only the right people can read it. Integrity: nobody has changed it without permission. Availability: it works when it is needed.
An attack harms at least one of the three. Naming which one tells you what to fix first.
Worked example: which one was harmed?
| What happened | Harmed | Why |
|---|---|---|
| A stranger reads a shop's customer list | Confidentiality | Private data was seen |
| A price is changed from £20 to £2 | Integrity | Data was changed without permission |
| The college website is flooded and will not load | Availability | Nobody can use it |
The cells students fill in are left blank in this preview.
Before you start
Note
Press Start the lab on the bar at the top. Your lab is a copy of an online shop that is weak on purpose. Each Run button types one command into your lab's terminal. These two only ask the shop for a page.
A page for everybody: one product
curl -s -o /dev/null -w "%{http_code}\n" http://juice-shop:3000/api/Products/1Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A page for signed-in people: the users
curl -s -o /dev/null -w "%{http_code}\n" http://juice-shop:3000/api/UsersShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
What the two numbers tell you
Each Run prints a status code, the number a web server answers with. The product prints 200, which means here it is. Anybody may see a product.
The users print 401, which means sign in first. The list of customers is an asset, and the shop keeps it confidential.
Attackers want different things
Attackers are not all the same. A criminal gang wants money. An activist wants to make a point. A country may want secrets.
Some attackers are already inside: an insider is a worker who misuses the access they were given. Others are beginners who use ready-made tools just to see what happens.
A common mistake
Warning
Many people think attackers only go after big companies. They do not. Most attacks are automatic and try every address they can find, so a small shop or a phone game is hit too. A small target is often an easier one.
The threats you will meet most
Most harm comes from a few threats. Phishing is a message that tricks you into giving away a password. Malware is software that does harm, such as ransomware, which locks files.
Weak passwords and old software with known holes are threats too. So is a simple mistake, such as emailing a file to the wrong person.
Sort incidents by what they harm
# Each incident says if data was read, changed or made unusable.
incident = {"read": True, "changed": False, "down": False}
# Change the True and False values above, then press Run.
if incident["read"]:
print("Confidentiality")
if incident["changed"]:
print("Integrity")
if incident["down"]:
print("Availability")
Going further
Think of an app you use every day, such as a bank, a game or a group chat. Write down its three most important assets.
For each one, name one threat and the attacker most likely to be behind it. Then say whether it harms confidentiality, integrity or availability.