Skip to main content

All weeks · Overview · Mock CTF

Week 17 · Lecture slides

Week 17

Contents7 sections

Reflection & Review

Pre-Final · Weeks 10–16 (+ callbacks)

Goal today

  • Consolidate Weeks 10–16
  • 🎯 Security Jeopardy: Champions Edition
  • 🧪 Mock final CTF (same team mechanic as Week 19 — not the same coverage, see below)

Map of the modern stack

A revision map for weeks 10 to 16, built on three spine properties every control needs: at a boundary, checked server-side per request (week 10's /api/users/3/orders); on by default, the safe path the only path (week 11's safe.rs bounds checks); fail closed, deny and log the reason, never the secret (week 15's port 8090 vs 8091). Then one row per week, each tied back to a first-half week it builds on: 10 API security builds on 6 authorization; 11 memory safety builds on 4 injection, the sink is now the stack; 12 supply chain builds on 2 SDLC, the scanner is now SCA/SBOM/cosign; 13 cloud/container builds on 3 crypto, a baked-in key is not a secret; 14 AI/LLM builds on 5 XSS, model output is untrusted input; 15 DevSecOps builds on 2 tooling, the same scanners now stop the build; 16 capstone builds on 1 threat modeling, the week 1 DFD is deliverable one.

🎯 Jeopardy: Champions Edition

Whole-course categories — modern stack + first-half callbacks:

APIMemorySupply ChainCloudAI/LLMDevSecOps

🧪 Mock final CTF

Not the same format as Week 19 — say so explicitly:

  • 8 challenges here vs. 12 in W19; Web is 1 optional callback here vs. 5 separate W19 challenges (60/150 pts)
  • No DevSecOps or Capstone challenge in either the mock or the W19 CTF (both stop at Week 14) — that content is examined on the Week 18 written paper instead (15/100 pts)
  • Mock has hints, ungraded; W19 has none, and is graded as half of the "Final" bucket — W18 written + W19 CTF together are 25% of the course grade, not W19 alone
  • Team-based, leaderboard — the team mechanic and general flow ARE the same, just not the coverage

Exam scope reminder

  • Wk 18 written: cumulative, emphasis on Weeks 10–15 (Week 16 capstone isn't separately examined)
  • Wk 19: capstone CTF tournament + final project demos (video walkthrough submitted before the session + a short live Q&A — not a live demo slot)

Final next week

Bring your project: threat model, SBOM, signed artifact, CI pipeline

All weeks in Software Security