🤔 Quick Quiz: Which IR 6.0 principle helps prevent SOC burnout? (2 mins)
⏱️ Timer: 2:00
A. More monitoring tools
B. Human-centric automation
C. Stricter policies
D. Longer shifts
🌍 Mission Context: The Shamoon Reality
افهم
University Tool: Case Study Analysis Market Test: Understanding Attack Impact
August 15, 2012: 35,000 Aramco computers destroyed in hours
🎯 Experience the Attack Timeline (3 mins)
⏱️ Timer: 3:00
(Adapt for online/in-person; use simulation)
Live Simulation: Watch the attack spread:
11:08 AM: First infection (1 computer)
11:15 AM: 100 computers infected
11:30 AM: 1,000 computers down
12:00 PM: 10,000 computers destroyed
2:00 PM: 35,000 computers - total destruction
Your Task: At what point would you pull the network cable?
💔 The Human Cost
• 35,000 employees couldn't work for weeks
• IT staff worked 24/7 for 2 weeks straight
• $15 million in immediate damages
• Global oil supply at risk
🤔 What made Shamoon so devastating?
A. It stole data
B. It destroyed data permanently
C. It was undetectable
D. It spread slowly
📚 CIA Triad: The Foundation
افهم
University Tool: Theoretical Models Market Test: Protecting Real Assets
🔍 Discover CIA Yourself (4 mins)
⏱️ Timer: 4:00
(Adapt for online/in-person)
With your neighbor, identify CIA violations:
Scenario
C, I, or A?
Why?
WhatsApp message leaked
?
Your answer...
Bank balance changed
?
Your answer...
Absher down for hours
?
Your answer...
Fake COVID certificate
?
Your answer...
WhatsApp: Confidentiality - Private info exposed
Bank: Integrity - Data corrupted
Absher: Availability - Service denied
COVID: Integrity - False data created
Definition: "Security engineering is about building systems to remain dependable in the face of malice, error, or mischance" (Anderson, 2008)
Market Reality: One CIA violation in SAMA systems could cost billions and destroy public trust.
⚖️ Security ≠ Safety: Critical Differences
افهم
University Tool: Comparative Analysis Market Test: Choosing Right Approach
Which approach if: (a) Train stops suddenly? (b) All screens show "HACKED"?
Aspect
Safety Focus
Security Focus
Saudi Example
Threat Source
Accidents, nature
Malicious actors
Hajj crowd vs cyber attack
Response
Can shutdown safely
Must stay operational
SAMA can't go offline
Failure Analysis
Open investigation
Attacker hides traces
Shamoon wiped logs
Environment
Predictable
Adversarial, adaptive
APT groups target Saudi
Market Reality: Treating security as safety led to Shamoon's success - no adversarial thinking.
🎯 Risk Assessment: STRIDE Model
مارس
University Tool: STRIDE Framework Market Test: Identifying Real Threats
🔍 Apply STRIDE to Tawakkalna (5 mins)
⏱️ Timer: 5:00
(Work in pairs; use worksheet)
Your Task: Find one threat for each STRIDE category
STRIDE
Threat Type
Tawakkalna Example
Islamic Violation
Control
Spoofing
Fake identity
Fake vaccine status
انتحال الشخصية
Biometric + Nafath
Tampering
Modify data
Change health status
تحريف البيانات
Blockchain logs
Repudiation
Deny actions
Deny permit request
إنكار الفعل
Digital signatures
Info Disclosure
Data leak
Medical records exposed
إفشاء السر
End-to-end encryption
Denial of Service
Block access
App crash during Hajj
منع العبادة
CDN + scaling
Elevation
Gain privileges
Access admin panel
تجاوز الصلاحيات
Zero trust + RBAC
Industry Tool: Microsoft Threat Modeling Tool for automated STRIDE analysis.
😈 Misuse Cases: Think Like an Attacker
مارس
University Tool: Misuse Case Diagrams Market Test: Preventing Real Attacks
🎭 Evil Twin Exercise (4 mins)
⏱️ Timer: 4:00
(Ethical hacking mindset)
Your Mission: Break into Absher (theoretically!)
Partner A: Describe normal use case
Partner B: Describe how to abuse it
Together: Design a defense
✅ Use Case
Login to Absher
Enter national ID
Enter password
Verify with Nafath
Access services
😈 Misuse Case
Hijack Account
Phishing for credentials
SIM swap for SMS
Man-in-the-middle
Session hijacking
🛡️ Security Use Case
Prevent Hijacking
Anti-phishing training
Device fingerprinting
Certificate pinning
Session timeout
# Example: Detecting account hijacking attempt def detect_suspicious_login(user_id, ip, device): # Check for unusual patterns if ip_location(ip) != user_usual_location(user_id):
send_alert("Login from unusual location")
require_additional_verification()
if device not in trusted_devices(user_id):
send_notification_to_registered_phone()
require_nafath_verification()
# Islamic principle: Trust but verify (الثقة مع التحقق)
log_access_attempt(user_id, ip, device, timestamp())
📋 10 Essential Security Requirements
مارس
University Tool: Firesmith's Framework Market Test: Complete Coverage
🎯 Requirement Mapping Game (3 mins)
⏱️ Timer: 3:00
Match each Saudi service to its PRIMARY requirement:
1. Identification
Who are you? Absher ID
2. Authentication
Prove it! Nafath
3. Authorization
What can you do? SAMA roles
4. Immunity
Resist attacks Aramco post-Shamoon
5. Integrity
Accurate data Hajj permits
6. Intrusion Detection
Spot attacks NCA SOC
7. Non-repudiation
Can't deny Sarie payments
8. Privacy
Protect personal Sehhaty records
9. Auditing
Track actions Government ops
10. Maintenance
Stay secure Regular updates
Market Reality: Missing even one requirement led to 70% of Saudi breaches in 2023.
🏗️ Secure Architecture: Two Approaches
اتقن
University Tool: Architecture Patterns Market Test: Building Resilient Systems
🛡️ Protection Architecture
🏰
Fortress Model (حصن)
Layers of defense:
Platform security (OS hardening)
Application security (Input validation)
Record security (Encryption)
Saudi Example: SAMA's banking platform
📊 Distribution Architecture
🌐
Spread Model (توزيع)
Minimize single points:
Replicated databases
Geographic distribution
Load balancing
Saudi Example: Hajj systems across regions
User Request
→
WAF Filter
→
Load Balancer
→
App Server
→
Database
📐 10 Security Design Guidelines
اتقن
🏗️ Design Challenge: Secure Madrasati (5 mins)
⏱️ Timer: 5:00
Apply 5 guidelines to fix Madrasati vulnerabilities:
#
Guideline
Madrasati Application
Fix
1
Base on explicit policy
No clear data retention
Define 5-year policy
2
Defense in depth
Only password auth
Add MFA + biometric
3
Fail securely
Shows error details
Generic error messages
4
Balance security/usability
15-char passwords
Passphrase option
5
Log user actions
No audit trail
Log all grade changes
6
Redundancy & diversity
Single server
Multi-region deployment
7
Validate inputs
SQL injection possible
Parameterized queries
8
Compartmentalize
All data accessible
School-level isolation
9
Design for deployment
Manual configuration
Infrastructure as Code
10
Design for recovery
No backup plan
Automated daily backups
💻 Secure Programming Practices
اتقن
🐛 Bug Hunt Challenge (4 mins)
⏱️ Timer: 4:00
Find 5 vulnerabilities in this code:
# Vulnerable Sarie payment system def process_payment(amount, account_from, account_to): # BUG 1: No input validation
query = f"SELECT balance FROM accounts WHERE id = {account_from}" # BUG 2: SQL injection vulnerability
balance = execute_query(query) # BUG 3: No error handling
if balance > amount: # BUG 4: Race condition - no locking
execute_query(f"UPDATE accounts SET balance = balance - {amount} WHERE id = {account_from}")
execute_query(f"UPDATE accounts SET balance = balance + {amount} WHERE id = {account_to}") # BUG 5: No logging of transaction return "Success" else: # BUG 6: Information disclosure return f"Insufficient funds. Current balance: {balance}"
# Secure version with Islamic principles def process_payment_secure(amount, account_from, account_to): # حفظ الأمانة - Protect the trust try: # Input validation if not validate_amount(amount) or not validate_accounts(account_from, account_to): return {"status": "error", "message": "Invalid request"}
# Use parameterized queries with transaction_lock():
balance = db.query("SELECT balance FROM accounts WHERE id = ?", [account_from])
if balance >= amount:
db.execute("UPDATE accounts SET balance = balance - ? WHERE id = ?", [amount, account_from])
db.execute("UPDATE accounts SET balance = balance + ? WHERE id = ?", [amount, account_to])
Must include: Threat model, security architecture, test results
Bonus: Working POC, bug bounty findings
Required Tools
OWASP ZAP for scanning
draw.io for threat modeling
GitHub for secure code
🎯 Key Takeaways - Chapter 13 Mastery
Summary: "Security engineering builds systems to remain dependable in the face of malice, error, or mischance through systematic application of principles, practices, and processes."
🧠 Foundations
• CIA Triad
• Security ≠ Safety
• Organizational policy