For Teachers · Back to the Module · Print with your browser's Print command.

F1 Worksheet: Security Basics

Student Worksheet (about 15 minutes, Foundations level)

Name: ______________________ Class: __________ Date: __________

Learning Objectives

• [ ] Explain confidentiality, integrity and availability with server examples.
• [ ] Distinguish an asset, a threat, a vulnerability and a risk.
• [ ] Apply least privilege and defence in depth to a Linux web server.

Key Terms

Write each definition in your own words.

• CIA Triad: ______________________________________________
• Asset: ______________________________________________
• Threat: ______________________________________________
• Vulnerability: ______________________________________________
• Risk: ______________________________________________
• Least Privilege: ______________________________________________
• Defence in Depth: ______________________________________________
• Attack Surface: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --lab vulnerable --out f1
2. Open f1/report.html. For three findings, write which CIA property each one threatens.
3. For NET-DB-001, list the layers that should have stopped the database being reachable.

Self-Check Questions

1. A backup file containing customer records is downloadable from the website. Which property is mainly affected?

• [ ] a) Availability
• [ ] b) Confidentiality
• [ ] c) Integrity
• [ ] d) None, because it is only a backup

1. Which statement best describes a vulnerability?

• [ ] a) A person who attacks systems
• [ ] b) A weakness that a threat can use
• [ ] c) The money lost in an incident
• [ ] d) The chance that an incident happens

1. Binding MySQL to 127.0.0.1 even though a firewall exists is an example of:

• [ ] a) Defence in depth
• [ ] b) Security through obscurity
• [ ] c) Availability testing
• [ ] d) Risk acceptance

1. A flood of half-open connections stops a web site answering real users. Which property is affected?

• [ ] a) Confidentiality
• [ ] b) Integrity
• [ ] c) Availability
• [ ] d) Authorisation

1. Why does a vulnerability assessment not, by itself, measure risk to your organisation?

• [ ] a) Because scanners cannot find vulnerabilities
• [ ] b) Because likelihood and impact depend on your environment
• [ ] c) Because risk only applies to networks, not servers
• [ ] d) Because the CVSS base score already includes your business impact

1. A web application's account can read every database on the server, but it needs only one. Which principle is broken?

• [ ] a) Defence in depth
• [ ] b) Least privilege
• [ ] c) Availability
• [ ] d) Security through obscurity

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• NIST SP 800-12 Rev. 1, An Introduction to Information Security: https://csrc.nist.gov/pubs/sp/800/12/r1/final
• NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments: https://csrc.nist.gov/pubs/sp/800/30/r1/final

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.