Upon completion of this tutorial, you will be able to:
Welcome to the culminating tutorial of Unit 1. Over the past nine tutorials, we have built a comprehensive foundation in computer and network security. We began with the fundamental concepts of the CIA triad, security services, and mechanisms (Tutorial 1.1). We explored the threat landscape—threat actors, attack vectors, and the cyber kill chain (1.2). We examined security models, principles, and architectures (1.3), and then delved into malware fundamentals (1.4) and specific malware families: viruses (1.5), worms, Trojans, and rootkits (1.6). We then explored bots, botnets, ransomware, and APTs (1.7), followed by DoS (1.8) and DDoS (1.9) attacks and defenses.
This final tutorial integrates all these concepts into a cohesive analytical framework. We move from theory to practice—applying the principles, models, and frameworks you have learned to analyze real-world security incidents and evaluate security architectures. This is the bridge between knowledge and application.
We begin with threat assessment, integrating threat modeling (STRIDE, DREAD), asset identification, vulnerability assessment, and risk analysis (ALE). We apply these to a realistic enterprise scenario, demonstrating how to prioritize risks and make informed security decisions.
We then conduct malware incident analysis, examining enterprise malware outbreaks and ransomware incidents. Using the cyber kill chain and APT lifecycle, we trace attacks from initial compromise to exfiltration, identifying points where defenses could have intervened.
Next, we analyze DoS/DDoS incidents across public-sector, enterprise, and cloud environments. We evaluate the effectiveness of defense mechanisms—rate limiting, scrubbing, CDN protection—and identify gaps in common deployments.
We then perform a security architecture evaluation, assessing defense-in-depth implementations, categorizing controls (administrative, technical, physical), and measuring security effectiveness using quantitative and qualitative metrics.
Finally, we review Unit 1, integrating key concepts, mapping cross-topic relationships, and preparing for Unit 2: Cryptographic Protocols, Tools, and Algorithms. You will emerge from this tutorial with a holistic understanding of computer and network security and the ability to apply this knowledge to protect real-world systems.
A comprehensive threat assessment integrates multiple analytical frameworks to provide a holistic view of an organization's security posture. It is the foundation upon which all security decisions are made.
Threat modeling is a structured approach to identifying and prioritizing potential threats to a system. Two widely used frameworks are STRIDE (categorizing threats) and DREAD (prioritizing them).
Assumption: Threat modeling assumes that system components and data flows are well-documented. In practice, incomplete documentation can lead to missed threats. Limitation: Threat modeling is a snapshot; it must be updated continuously as systems evolve.
Assets are the resources an organization must protect. Effective asset identification involves:
Assumption: All assets can be identified and valued. In reality, shadow IT and undocumented assets often exist, creating blind spots.
Vulnerability assessment identifies weaknesses in assets that could be exploited. This includes:
Assumption: Vulnerability scanners can detect all known vulnerabilities. Zero-day vulnerabilities are missed by definition, requiring behavioral and anomaly detection.
Risk analysis combines asset value, threat likelihood, and vulnerability severity to estimate risk. The Annualized Loss Expectancy (ALE) formula:
ALE = SLE × ARO
Assumption: Risks can be quantified with reasonable accuracy. In practice, ARO and SLE are often subjective estimates. Limitation: ALE does not capture non-linear impacts (e.g., reputational damage cascading into revenue loss). Qualitative risk matrices (Likelihood × Impact) complement quantitative analysis.
| Asset | Threat (STRIDE) | Vulnerability | Risk (ALE/Qualitative) | Priority (DREAD) |
|---|---|---|---|---|
| Customer Database | Information Disclosure | Unpatched SQL injection | High (SLE $2M, ARO 0.2) | High |
| Web Server | DoS | No rate limiting | Medium (SLE $500k, ARO 1.0) | Medium |
| Admin Credentials | Spoofing | No MFA | High (SLE $5M, ARO 0.1) | High |
Analyzing an enterprise malware outbreak requires tracing the attack through the Cyber Kill Chain or APT Lifecycle. A typical analysis includes:
Case Study: The 2017 Emotet outbreak (initially a banking Trojan, later a loader) used email spam with malicious attachments. It propagated via network shares and email contacts. The malware evaded signature-based AV through polymorphism and frequent updates. Containment required isolating infected hosts, blocking C2 domains, and reimaging systems. Lessons: user awareness training, endpoint detection (EDR), and network segmentation are critical.
Ransomware incidents follow a distinct pattern. Analysis should cover:
Case Study: The 2021 Colonial Pipeline ransomware attack used a compromised VPN password (no MFA). The attackers encrypted critical systems and demanded a ransom. The company paid ~$4.4 million. Defensive failures: lack of MFA, inadequate network segmentation between IT and OT. Lessons: enforce MFA, segment networks, and maintain offline backups.
Public-sector organizations (government, healthcare, education) are frequent DDoS targets. Analysis must consider:
Case Study: In 2020, several U.S. state election websites faced DDoS attacks during voting periods. While most services remained operational, the attacks highlighted the need for scalable DDoS protection (e.g., AWS Shield, Akamai) and redundancy.
Enterprise outages from DDoS attacks require analysis of:
Case Study: A major e-commerce platform suffered a 3-hour outage during a peak sales event, losing $5 million in revenue. The attack was a DNS amplification (50 Gbps) that overwhelmed their on-premises scrubbing capacity. The company subsequently migrated to a cloud-based DDoS protection service.
Cloud service disruptions are particularly impactful due to the concentration of services. Analysis includes:
| Incident | Attack Type | Volume | Defense | Outcome |
|---|---|---|---|---|
| Dyn DNS (2016) | Mirai botnet (DDoS) | 1.2 Tbps | Limited (DNS infrastructure) | Major internet disruption |
| AWS Shield (2020) | UDP reflection | 2.3 Tbps | Cloud-based scrubbing | Mitigated, service maintained |
| GitHub (2018) | Memcached amplification | 1.35 Tbps | Akamai scrubbing | Mitigated, no downtime |
Evaluating defense-in-depth involves examining each layer of security controls:
Assessment criteria: coverage, redundancy, and the ability to detect and respond to attacks at each layer.
Controls are categorized as administrative, technical, or physical. Evaluation should consider:
Measuring security effectiveness uses both quantitative and qualitative metrics:
Assumption: Effectiveness can be measured objectively. In practice, many security benefits are difficult to quantify, leading to reliance on compliance checklists.
Unit 1 has covered a broad range of concepts. Key integrative themes include:
Understanding how topics connect is essential:
Unit 2 focuses on Cryptographic Protocols, Tools, and Algorithms. The concepts from Unit 1 provide the context for understanding:
Key questions to consider as you move to Unit 2:
Unit 1 Key Takeaway: Security is a holistic discipline integrating technology, people, and processes. The principles and models learned here—CIA triad, defense-in-depth, threat modeling, risk management—are the foundation for all subsequent study in computer and network security.
Test your understanding of integrated security analysis. Questions range from foundational to advanced analytical levels.
Question 1 (Foundational): In the STRIDE threat model, which category addresses the risk of an attacker pretending to be a legitimate user?
Question 2 (Foundational): The formula ALE = SLE × ARO is used in which type of analysis?
Question 3 (Intermediate): In the Cyber Kill Chain, which phase involves the attacker delivering the malicious payload to the target?
Question 4 (Intermediate): Which of the following is a key indicator of a ransomware double-extortion attack?
Question 5 (Intermediate): In the DREAD risk assessment model, what does the "E" stand for?
Question 6 (Intermediate): A company uses a WAF to block malicious HTTP requests. This is an example of which type of security control?
Question 7 (Advanced): The Colonial Pipeline ransomware attack succeeded largely because of a failure in which security principle?
Question 8 (Advanced): A security architecture evaluation finds that the organization has strong perimeter controls but weak internal segmentation. This is a violation of which principle?
Question 9 (Advanced): A company experiences a DDoS attack using DNS amplification. Which of the following defenses would have been most effective at the network level?
Question 10 (Advanced Scenario): An organization's threat model identifies a high risk of insider threat from a disgruntled employee with privileged access. Which combination of controls is most effective for this scenario?
Question 11 (Theoretical): Explain how the concepts of threat modeling, vulnerability assessment, and risk analysis are integrated in a comprehensive security assessment.
Question 12 (Advanced Scenario): A company suffers a ransomware attack where attackers encrypted critical files and threatened to leak sensitive customer data. The company had offline backups and restored operations without paying. However, customer data was leaked, causing reputational damage. Which aspects of the incident response were successful, and which failures remain?
Apply your knowledge through these integrated analysis scenarios.
Exercise 1 (Intermediate): Threat Assessment Integration
A financial services company has identified three critical assets: (1) a customer database with 10 million records (value: $10 million), (2) a transaction processing system generating $1 million per hour during peak hours, and (3) intellectual property for a new algorithm valued at $5 million. Using the integrated threat assessment framework, (a) identify at least two threats for each asset using STRIDE; (b) estimate the ALE for a data breach (SLE=$2M, ARO=0.15) and a DoS attack on the transaction system (SLE=$0.5M, ARO=2); (c) prioritize the risks using DREAD scoring.
(a) Asset 1 (Customer DB): Information Disclosure (data breach), Tampering (data modification). Asset 2 (Transaction System): DoS (availability), Spoofing (unauthorized transactions). Asset 3 (IP): Information Disclosure (theft), Tampering (code modification).
(b) ALE (Data Breach) = $2M × 0.15 = $300,000. ALE (DoS) = $0.5M × 2 = $1,000,000.
(c) DREAD scoring (1-3): Data Breach: Damage=3, Reproducibility=2, Exploitability=3, Affected=3, Discoverability=2 → 13/15. DoS: Damage=2, Reproducibility=3, Exploitability=3, Affected=2, Discoverability=2 → 12/15. Both are high priority.
Exercise 2 (Advanced): Malware Outbreak Analysis
A hospital network experiences a malware outbreak. The security team observes: (a) phishing emails with malicious attachments targeting administrative staff; (b) unusual scheduled tasks on several workstations; (c) outbound connections to a suspicious domain; (d) lateral movement to the EHR server; (e) file encryption on the server. Using the Cyber Kill Chain, map each observation to a phase. For each phase, recommend a specific control that could have prevented or detected the attack.
(a) Delivery (phishing attachments). Control: Email filtering with attachment sandboxing.
(b) Installation/Persistence (scheduled tasks). Control: Endpoint detection and response (EDR) with behavioral monitoring.
(c) C2 (outbound connections). Control: Network monitoring and DNS filtering.
(d) Lateral Movement (to EHR server). Control: Network segmentation and least privilege.
(e) Actions on Objectives (encryption). Control: Data backups (offline) and anti-ransomware features.
Exercise 3 (Advanced): DDoS Incident Analysis
A major online retailer is hit by a DDoS attack during a holiday sale. The attack: (a) is a UDP flood saturating the 10 Gbps link; (b) uses spoofed source IPs; (c) includes a DNS amplification component. The retailer has a 20 Gbps scrubbing service. (a) Why did the attack succeed despite the scrubbing service? (b) What additional defenses could have prevented the attack? (c) Calculate the revenue loss if the attack lasts 4 hours during peak revenue of $2M/hour.
(a) The attack exceeded the 10 Gbps link capacity despite the scrubbing service; the scrubbing service bandwidth is 20 Gbps, but the link to the retailer is only 10 Gbps, so the link saturated before scrubbing could be effective.
(b) Additional defenses: Multi-homing with multiple ISPs; deploying cloud-based DDoS protection that can absorb traffic before it reaches the link; implementing BCP38 to prevent spoofed traffic; using DNS sinkholing for amplification.
(c) Revenue loss = $2M/hour × 4 hours = $8 million.
Exercise 4 (Advanced): Security Architecture Evaluation
A company has deployed: (a) Next-gen firewall at the perimeter; (b) EDR on all workstations; (c) WAF for web applications; (d) encryption for data at rest and in transit; (e) security awareness training. However, a recent breach occurred through a compromised vendor account with access to internal systems. (a) Which layer of defense failed? (b) What control category (administrative, technical, physical) was weakest? (c) Propose at least three recommendations to strengthen the architecture.
(a) The "People" layer (vendor access) and "Network" layer (internal segmentation) failed. The vendor account had excessive access, and there was no segmentation limiting vendor access.
(b) Administrative controls were weakest—vendor risk management and access control policies were insufficient.
(c) Recommendations: (1) Implement a vendor risk assessment program with periodic reviews; (2) Apply least privilege to vendor accounts and enforce MFA; (3) Implement network segmentation to restrict vendor access to specific resources; (4) Monitor vendor activity with UBA.
Exercise 5 (Advanced Research): Integrated Case Study
Research the SolarWinds attack (2020). Write an integrated analysis that covers: (a) the threat actors and their motivations; (b) the attack vectors and phases (Cyber Kill Chain); (c) the assets and data compromised; (d) the security failures (which principles were violated); (e) the response and lessons learned; (f) how a defense-in-depth architecture with Zero Trust could have mitigated the attack.
SolarWinds Analysis: (a) Nation-state actors (APT29) motivated by espionage. (b) Kill Chain: Reconnaissance (studied build process), Weaponization (inserted SUNBURST backdoor), Delivery (software updates), Exploitation (customers installed), Installation (persistence), C2 (communicated with attacker domains), Actions (data exfiltration). (c) Compromised: Orion software, network credentials, government and corporate data. (d) Failures: Defense in Depth (single compromised build), Supply-chain security (lack of code integrity), Least Privilege (overly broad access). (e) Response: Takedown of C2 domains, patching, incident response. Lessons: Need for SBOM, code signing, and Zero Trust. (f) Zero Trust: Micro-segmentation would have limited lateral movement; code integrity checks would have detected the backdoor; continuous monitoring would have detected C2 traffic earlier.
These assignments require deep research, analysis, and synthesis across multiple Unit 1 topics.
Homework 1: Comprehensive Enterprise Security Assessment
Conduct a comprehensive security assessment for a fictional enterprise of your choice (e.g., a hospital, bank, university, e-commerce platform). Your assessment must include: (a) asset inventory and criticality ranking; (b) threat modeling using STRIDE for each asset; (c) vulnerability assessment and risk analysis (ALE where applicable); (d) recommended controls (administrative, technical, physical); (e) a defense-in-depth architecture diagram; (f) a prioritized action plan based on risk.
Hospital Security Assessment: Assets: EHR system (critical), patient data (confidential), medical devices (availability). Threats: Ransomware (DoS), data breach (Disclosure), device compromise (Tampering). ALE: Ransomware ($2M × 0.2 = $400k). Controls: MFA, network segmentation, air-gapped backups. Architecture: Perimeter firewall, internal segmentation, EDR, encryption, training. Action plan: 1) MFA for all remote access, 2) network segmentation for medical devices, 3) ransomware tabletop exercises.
Homework 2: Comparative Analysis of Ransomware Incidents
Compare and contrast the WannaCry, NotPetya, and Colonial Pipeline ransomware incidents. In your 800-word analysis, address: (a) the attack vectors and propagation methods; (b) the payload and objectives; (c) the impact on the affected organizations; (d) the defensive failures in each case; (e) the lessons learned and recommendations for future prevention.
WannaCry: Worm-based, EternalBlue exploit, encryption for ransom. Impact: 200k+ systems. Failure: patch management. NotPetya: Wiper disguised as ransomware, EternalBlue + credential theft. Impact: billions in damage. Failure: network segmentation. Colonial Pipeline: Ransomware via compromised VPN (no MFA). Impact: fuel supply disruption. Failure: MFA and OT security. Lessons: Patch management, MFA, segmentation, and offline backups are critical.
Homework 3: DDoS Defense Strategy Design
Design a comprehensive DDoS defense strategy for a multinational corporation with a global customer base. The strategy must include: (a) detection mechanisms (baselining, monitoring); (b) mitigation techniques (rate limiting, scrubbing, CDN); (c) cloud-based and on-premises components; (d) cost-benefit analysis (calculate ALE reduction); (e) an incident response playbook specific to DDoS attacks; (f) recommendations for coordination with ISPs and cloud providers.
Strategy: Detection: NetFlow, SIEM with anomaly detection. Mitigation: AWS Shield Advanced + Cloudflare CDN, on-premises scrubbing. Cost: $200k/year for cloud protection. ALE without protection: $5M (based on 2 attacks/year × $2.5M loss). ALE with protection: $500k (mitigated attacks). Reduction: $4.5M/year. Incident response: 1) Detect, 2) Verify, 3) Engage cloud provider, 4) Rate-limit, 5) Blackhole if needed, 6) Post-mortem.
Homework 4: Zero Trust Architecture Evaluation
Research the principles of Zero Trust architecture. Then, evaluate a traditional perimeter-based enterprise network and propose a migration path to Zero Trust. Your 700-word report must include: (a) the key tenets of Zero Trust; (b) the limitations of perimeter-based security; (c) the steps to implement Zero Trust (identity, network, application, data); (d) a comparison of security controls before and after migration; (e) the challenges of migration and how to address them.
Zero Trust: "Never trust, always verify." Tenets: verify explicitly, least privilege, assume breach. Perimeter limitations: insider threats, lateral movement, supply-chain attacks. Migration: 1) Identity (MFA, IAM), 2) Network (micro-segmentation), 3) Application (application-layer controls), 4) Data (encryption, DLP). Controls before: firewall, VPN. After: identity-aware proxy, ZTNA. Challenges: legacy systems, user friction; address with phased rollout and user training.
Homework 5: Unit 1 Concept Map and Reflection
Create a comprehensive concept map that visually represents the relationships between the major topics covered in Unit 1 (Tutorials 1.1–1.9). Then, write a 500-word reflective essay that: (a) explains the structure of your concept map; (b) identifies the three most important concepts you learned; (c) discusses how these concepts connect to real-world security challenges; (d) reflects on how your understanding of computer and network security has evolved; (e) identifies areas you want to explore further in Unit 2.
Concept Map: Central node: Security Objectives (CIA). Connected to: Threats (1.2), Principles (1.3), Malware (1.4-1.7), DoS/DDoS (1.8-1.9). Threat modeling (1.3) connects threats to architecture (1.3). Risk management (1.3) connects all.
Most important concepts: (1) Defense-in-Depth—layered controls are essential; (2) Cyber Kill Chain—understanding attack phases enables proactive defense; (3) Zero Trust—the future of security architecture.
Real-world connections: SolarWinds (supply-chain), Colonial Pipeline (ransomware), Dyn DNS (DDoS) illustrate the importance of these concepts.
Evolution: From viewing security as technical controls to understanding it as a holistic discipline.
Future exploration: Cryptography (Unit 2)—how encryption implements confidentiality and integrity.
This culminating tutorial has integrated the full breadth of Unit 1 concepts into a coherent analytical framework for security assessment and incident analysis. We began with threat assessment, demonstrating how asset identification, threat modeling (STRIDE), vulnerability assessment, and risk analysis (ALE) combine to provide a comprehensive view of security posture. The key takeaway is that risk management is not a one-time activity but an ongoing process of continuous improvement.
We then conducted malware incident analysis, applying the Cyber Kill Chain and APT lifecycle to real-world outbreaks. The Colonial Pipeline and Emotet cases illustrated how attackers exploit gaps in defense-in-depth—lack of MFA, insufficient segmentation, and inadequate patch management. Each incident provides lessons for improving detection and response capabilities.
Our DoS/DDoS incident analysis examined attacks across public-sector, enterprise, and cloud environments. The comparison of Dyn DNS, AWS Shield, and GitHub incidents highlighted the importance of scalable defenses, such as cloud-based scrubbing and CDN protection, while also revealing the limitations of even the most robust defenses.
The security architecture evaluation framework provided a structured way to assess layered defenses, categorize controls (administrative, technical, physical), and measure effectiveness using quantitative metrics (MTTD, MTTR) and qualitative assessments (maturity, red-team results).
Finally, our Unit 1 review mapped the relationships between topics—from CIA triad and security models to malware families and DoS defenses—and prepared you for Unit 2, where cryptographic protocols and algorithms will provide the technical foundation for many of the security services we have discussed.
You have now completed the foundational unit of COMP400. The concepts, principles, and frameworks you have mastered here are the essential toolkit for any security professional. As you move to Unit 2, remember that cryptography is a tool, not an end in itself. Its purpose is to enable the security objectives—confidentiality, integrity, authenticity, and nonrepudiation—that we have explored in depth. The threat models and architectural principles you have learned will guide you in applying cryptographic tools effectively and securely.