Week 17 · slides

Week 17

← all weeks · readme · mock-ctf


marp: true theme: default paginate: true header: "Software Security · Week 17 · Review"


Week 17

Reflection & Review

Pre-Final · Weeks 10–16 (+ callbacks)

<!-- Same energy as W7 — game, not lecture. Frame: consolidate the modern stack + a few first-half callbacks; zero surprises for the final. ~2 min. -->


Goal today

  • Consolidate Weeks 10–16
  • 🎯 Security Jeopardy: Champions Edition
  • 🧪 Mock final CTF (Week 19 format)

<!-- Roadmap. Open with the cumulative review quiz (quiz2.md, 25 pts) per AGENDA, then the games. -->


Map of the modern stack

WkTopicOne-line
10API securitycheck ownership; bind intended fields
11Memory safetyfuzz, exploit, go memory-safe
12Supply chainSBOM, SLSA, sign & verify
13Cloud/containerleast privilege, no misconfig
14AI/LLMprompt injection; least-privilege tools
15DevSecOpsautomated gates; fail closed

<!-- Cold-call one student per row for the one-liner (retrieval). Add 2–3 first-half callbacks (injection, auth) since the final is cumulative. ~10 min. -->


🎯 Jeopardy: Champions Edition

Whole-course categories — modern stack + first-half callbacks:

APIMemorySupply ChainCloudAI/LLMDevSecOps

<!-- Same run as W7 but whole-course. Seed questions from exams/item-bank.md (final pool). Teams = Houses; Final-Jeopardy wager; points to the CTFd board. ~60–75 min. -->


🧪 Mock final CTF

Same format as Week 19:

  • Web · API · supply chain · cloud · binary · LLM
  • Team-based, leaderboard

<!-- Run the EXACT W19 team format (mock-ctf.md / CTF pool), incl. a binary (toolbox container) + LLM challenge so nothing is new on final day. ~90 min. -->


Exam scope reminder

  • Wk 18 written: cumulative, emphasis on Weeks 10–16
  • Wk 19: capstone CTF tournament + final project demos

<!-- State scope + logistics clearly. Remind teams the W19 demo is graded — bring a runnable project. ~3 min. -->


Final next week

Bring your project: threat model, SBOM, signed artifact, CI pipeline

<!-- Close: checklist of what to bring to W19; confirm project repos run. -->