Introduction to Security and Privacy

Assets, stakeholders, and threat models

Security starts with identifying what matters, to whom, and against which adversaries. An asset can be account access, private correspondence, availability, or the integrity of a decision. A threat describes a possible harmful event; a vulnerability is a weakness that may enable it; risk also considers likelihood and consequence. List trust boundaries where information or authority crosses between components. A school messaging service, for example, must consider students, teachers, administrators, outsiders, and the service operator. Different stakeholders can have conflicting goals, so assumptions should be explicit.

References: COMP 2109 A — Fall 2026 course outline · OWASP — Web Security Testing Guide

Least privilege, mediation, and secure failure

Least privilege gives each component only the authority required for its task. Complete mediation checks permission whenever a protected operation occurs rather than trusting a previously displayed page. Secure failure preserves an appropriate protection when something goes wrong: a database timeout should not accidentally grant access. Defense in depth combines controls whose failures are not identical. Simplicity improves the ability to inspect and maintain these rules. Distinguish authentication, which establishes an identity claim, from authorization, which determines what the authenticated or anonymous actor may do.

References: COMP 2109 A — Fall 2026 course outline · OWASP — Web Security Testing Guide

Software vulnerabilities and defensive testing

Input becomes dangerous when a program treats untrusted data as instructions or trusts it to determine authority. Parameterized database operations separate query structure from data; context-appropriate output handling reduces unintended script interpretation. Server-side authorization remains essential even if a user interface hides a button. Security tests should examine expected denials and invalid state transitions as carefully as successful actions. Work within an explicitly authorized system and use synthetic data when possible. Findings should describe the violated property, reproducible conditions, impact, and a focused correction rather than merely naming a vulnerability category.

References: COMP 2109 A — Fall 2026 course outline · OWASP — Web Security Testing Guide

Privacy, inference, and data minimization

Privacy concerns what processing does to people, including collection, linkage, inference, disclosure, and retention. Data can be secured against outsiders while still being collected or used in ways that harm the person it describes. Removing names does not necessarily prevent reidentification when timestamps, locations, or rare attributes can be linked to other sources. Data minimization reduces the information required for a purpose; retention limits reduce how long exposure persists. Explain defaults and choices clearly, and evaluate whether users can make a meaningful decision about the processing.

References: COMP 2109 A — Fall 2026 course outline · NIST — Privacy Framework

Worked case: a campus attendance application

Suppose an attendance app collects a student identifier, precise GPS location every minute, and contact lists to prove lecture attendance. The purpose may require only a class-specific attendance event, making the extra collection difficult to justify technically. Threats include account takeover, an unauthorized administrator query, exposed logs, and later use of location history. Possible design changes include collecting a minimal check-in proof, restricting roles, limiting retention, and recording administrative access. Each change should be assessed against a stated abuse scenario and the legitimate attendance workflow.

References: COMP 2109 A — Fall 2026 course outline · OWASP — Web Security Testing Guide · NIST — Privacy Framework

Abuse, anonymity, governance, and ethical analysis

Security mechanisms operate inside institutions and social incentives. Anonymity can protect vulnerable speakers while complicating abuse response; identification can support accountability while increasing surveillance. Compare proposed controls using evidence about the harm, effectiveness, affected groups, and alternatives. Malware and fraud often exploit human workflows as well as technical flaws, making recovery and understandable warnings part of the system. Governance defines who can change rules, audit decisions, and challenge errors. For legal requirements, consult the current applicable primary law and institutional policy rather than assuming a technical framework establishes compliance.

References: COMP 2109 A — Fall 2026 course outline · NIST — Privacy Framework

Practice & worked answers

Original exercises for this guide.

Public notes & references

Course sources establish the scope above. Reference materials support the explanations; linked lecture notes and books remain with their authors.

• COMP 2109 A — Fall 2026 course outline ↗Course scope · Fall 2026
• OWASP — Web Security Testing Guide ↗Primary reference · Public reference; checked 2026-11-05
• NIST — Privacy Framework ↗Primary reference · Public reference; checked 2026-11-05