Security and professional ethics
แนะนำใหม่
คำศัพท์
| English | ความหมาย |
|---|---|
| threat model | threat model |
English
Assets, entry points, attackers
- A threat model lists assets (member records, loan history), entry points (web form, API, reminder channel), attackers (opportunistic, insider, automated) — then pairs each threat with a mitigation.
{exercise:uni-cs1206-model}
ฝึกฝน
A threat model pairs —
ความยาก 1/5 · 100 เหรียญ + บอนัสน้อยๆ เมื่อทำสำเร็จครั้งแรกในวันนี้
Assets x entry points x attackers, then a mitigation per threat.
English
Least privilege, counted
- BookShare's authorisation matrix: 3 roles x 6 actions = 18 cells, 4 allowed — 14 denials by default. Least privilege as a countable property.
- The search form closes its SQL-injection row with parameterised queries and a length cap — tested by feeding
' OR '1'='1and asserting zero rows leaked.
{exercise:uni-cs1206-privilege}
ฝึกฝน
The authorisation matrix allows — of 18 cells
ความยาก 1/5 · 100 เหรียญ + บอนัสน้อยๆ เมื่อทำสำเร็จครั้งแรกในวันนี้
3 roles x 6 actions, 4 allowed: 14 denials by default.
English
The ethics call
- The product owner asks to sell reading history to advertisers. The professional codes put privacy harm and public interest above employer preference: documented refusal with alternatives (anonymised aggregate with consent) — ethics is a decision with a paper trail, not a feeling.
- "Internal tool" is not a security exemption; authorisation by hiding links fails because the endpoint still answers.
{exercise:uni-cs1206-ethics}
ฝึกฝน
The professional answer to the data-sale request is —
ความยาก 1/5 · 100 เหรียญ + บอนัสน้อยๆ เมื่อทำสำเร็จครั้งแรกในวันนี้
Codes put privacy and public interest above employer preference - the paper trail is the point.