Capstone Studio & CTF Warm-up
Software Security · Nutthakorn Chalaemwongwan
Today
- Work-in-progress capstone demos
- Cross-team peer review
- 🏆 Practice CTF tournament (previews Week 19)
Capstone — what good looks like
- Clear threat model → real vulnerabilities → working fixes
- SBOM + signed artifact
- Security CI pipeline that gates the build
- Story: attack → root cause → fix
The whole term, one lookup table
Demo format (today, ungraded)
- 10-min demo + 5-min Q&A
- Show one full attack→fix walkthrough — live unless your environment breaks, then a recorded fallback is fine (this is a rehearsal, not the Week 19 format)
- Get peer feedback before the graded Week 19
Peer review rubric
- Is the threat model complete?
- Are findings CWE/OWASP-mapped & reproduced?
- Do the fixes actually close the bug?
- Is the pipeline real (fails on findings)?
🏆 Practice CTF
- Mixed web / API / binary / supply-chain / cloud / LLM — 9 challenges, 6 categories
- Boss challenge: chains two bugs on NoteVault itself — your term project's own starter app
- Cross-team scrimmage, dry run for the Week 19 tournament
Before Week 19
- Fix gaps peers flagged
- Finalize SBOM + signing + pipeline
- Rehearse the demo
Next: pre-final review (Week 17)
Then the final — Wk 18 written · Wk 19 capstone CTF