Weekly tutorials forum

Group 3. An estate agent web application. Olha, Marzena, Tanya, Maxim

Tue, 06 Oct 2026 11:58:40 GMT

by Olha Kozmenko.

a) Each group will analyse their assigned scenario in the context of potential security threats.

1- Identify Threats

2- Discuss and list potential threats to the system.

3- Categorise these threats in three categories • Internal threats: Threats originating from within the organization (e.g., employees, insider attacks, misconfigurations). • External threats: Threats coming from outside the organization (e.g., hackers, malware, DDoS attacks). • Incidental threats: Threats that are accidental in nature
• customer accounts

• property listings

• booking/viewing system

• contact forms

• admin/employee accounts

• customer personal data

• possibly uploaded documents

Identify Threats

• stolen passwords

• SQL injection

• phishing

• employee stealing customer data

• DDoS • ransomware

• accidental deletion

• wrong permissions

• accidental email sent to wrong person

• Discuss the Who could cause it?

• What part of the system could be affected?

• What could happen as a result? SQL Injection Attacker: external hacker Target: website/database Result: customer data could be stolen or modified.

Categorise the threats

 Internal threats

External threats

Incidental threats

Employee steals customer data SQL

Injection Employee deletes a listing by mistake

Employee changes property details

Phishing Wrong customer receives an emai

l Excessive staff permissions DDoS attack Incorrect property price entered Poor internal configuration Ransomware Accidental data exposure5.
• Insider data theft • Excessive privileges • SQL Injection • Phishing • Account takeover • DDoS • Ransomware • Accidental deletion • Accidental data disclosure
Internal threats Threats caused by employees or people inside the organisation, either intentionally or because of poor internal security. External threats Threats caused by attackers outside the organisation, such as hackers, malware or DDoS attacks. Incidental threats Threats caused accidentally, usually through human error or incorrect configuration. Person 1: Internal threats Person 2: External threats SQL injection, phishing, DDoS, ransomware, account takeover. Person 3: Incidental threats human error, accidental deletion, incorrect data, accidental disclosure.
b) Classify Threats by Security Tenets 1- Each identified threat should be analysed based on which security tenet it violates: Confidentiality – Unauthorised access to sensitive data. Integrity – Data is altered or manipulated in an unauthorised manner. Availability – Systems and data are not accessible when needed. Non-repudiation – Users can deny their actions or transactions. Accountability – The ability to track user actions is compromised.

o Confidentiality o Integrity o Availability o Non-repudiation o Accountability Estate Agent Web Application:  Threat Security Tenet(s) Why? Employee steals customer data Confidentiality Sensitive customer data is accessed without permission Employee changes property price Integrity Property information is changed without authorisation SQL Injection Confidentiality, Integrity, Availability Attacker may read, modify or delete database records Phishing Confidentiality, Integrity Stolen credentials may give attackers access to accounts and data Account takeover Confidentiality, Integrity Attacker can access private data and change information DDoS attack Availability Website becomes unavailable to customers Ransomware Availability, Integrity, Confidentiality Data may be encrypted, changed or stolen Accidental deletion of records Integrity, Availability Data is removed and may no longer be available Accidental email sent to wrong customer Confidentiality Sensitive information is disclosed to an unauthorised person Deleted or modified audit logs Accountability, Non-repudiation It becomes difficult to prove who performed an action • Confidentiality: Can someone see data they should not see? • Integrity: Can someone change data without permission? • Availability: Can the system or data become unavailable? • Non-repudiation: Can someone deny that they performed an action? • Accountability: Can we identify and track who performed the action? Person 1: Confidentiality + Integrity Person 2: Availability DDoS, ransomware, deletion, server failure. Person 3: Non-repudiation + Accountability c) Discussion Questions 1- What are the most critical threats in this scenario? 2- How do these threats impact the business and its users? 3- Are there existing measures that mitigate these threats? 4- What additional security measures could be implemented? Presentation and Class Discussion (10 minutes each) Each group will briefly present their findings, explaining: 5- The identified threats and how they are categorised. 6- The impact of these threats on security tenets. 1. Estate Agent Web Application • Data breach / customer data theft • Account takeover / phishing • SQL Injection • Ransomware or DDoS 2. Data breach Business impact: • Reputation damage • Possible legal/regulatory consequences • Financial loss • Loss of customer trust User impact: • Personal data exposure • Identity theft risk • Fraud or phishing • Loss of confidence in the company 3. Existing or commonly used measures may include: • HTTPS • Password authentication • Firewall • Antivirus / endpoint protection • Access permissions • Backups • Logging 4 Multi-Factor Authentication • Role-Based Access Control • Strong password policy • Secure coding • Parameterised SQL queries • Input validation • Encryption • Regular backups • Patch management • Security monitoring • Audit logs • Staff phishing awareness training • Regular vulnerability testing  Critical Threat Business Impact User Impact Existing Measures Additional Measures Data breach Financial and reputational damage Personal data exposure Access control, HTTPS Encryption, MFA, monitoring Account takeover Unauthorised access to system Account/data misuse Password authentication MFA, login limits SQL Injection Database compromise Customer data may be stolen Firewall Parameterised queries, input validation Ransomware Business operations may stop Services unavailable Antivirus, backups EDR, isolated backups, patching DDoS Website downtime and lost customers Cannot access properties Firewall DDoS protection, traffic filtering
1: What are the most critical threats? We consider data breaches, account takeover, SQL injection and ransomware to be the most critical threats because they can expose sensitive customer information, compromise the database and interrupt business operations. 2: How do they impact the business and users? For the business, cyberattacks can cause financial losses, reputational damage, downtime and loss of customer trust.

For users, the main risks include exposure of personal information, fraud, identity theft and loss of access to the service. 3: Are there existing measures? Common existing security measures include HTTPS, password authentication, firewalls, antivirus software, access permissions, backups and security logging. However, these controls may not completely prevent advanced attacks. 4: What additional measures could be implemented? Additional measures could include MFA, role-based access control, encryption, secure coding practices, regular vulnerability assessments, improved monitoring, employee security training and secure offline backups.
Identified threats and how they are categorised a): • Internal • External • Incidental
Impact on security tenets b): • Confidentiality • Integrity • Availability • Non-repudiation • Accountability
SQL injection can affect confidentiality because attackers may read customer data, integrity because they may modify records, and availability because they may delete
Scenario introduction + Internal / External / Incidental threats.
Security tenets + threat classification.
Critical threats, business/user impact and security measures.

group 1 holiday booking system

Tue, 06 Oct 2026 11:56:30 GMT

by Mohammed Hamid.

Online Holiday Booking System Group 1

Identify threat

- Customer details

- Payment details

- Login details

Threats

- Phishing

- SQL injection

- Payment fraud

- Human error

- Insider data theft

- Unauthorised access

- Accidental data loss

Internal Threats

- Insider data theft

- Unauthorised employee access

External Threats

- Phishing

- SQL injection

- Payment fraud

- Insider threat

- Human error

- Accidental data loss

phisphising

B0)phi

Threat	Confidentiality	Integrity	Availability	Non-repudiation	Accountability
Phishing	✓			✓	✓
SQL Injection	✓	✓			✓



Payment Fraud	✓	✓		✓	✓
Insider Data Theft	✓				✓
Unauthorised Access	✓	✓			✓


Human Error	✓	✓	✓		✓
Data Loss		✓	✓

1. What are the most critical threats in this scenario?

The most critical threats to an online holiday booking system are:

Phishing and account hacking – attackers could steal customer usernames, passwords and personal information.
SQL injection – attackers could gain unauthorised access to the booking database.
Payment fraud – criminals could steal payment information or make fraudulent transactions.
Data breaches – sensitive customer information such as names, addresses and passport details could be exposed.
Insider threats – employees could intentionally or accidentally access, change or share customer information.

2. How do these threats impact the business and its users?

Impact on customers:

Personal and payment information could be stolen.
Customers could lose money through fraudulent transactions.
Holiday bookings could be changed or cancelled without permission.

Impact on the business:

Financial losses from fraud and system downtime.
Damage to the company's reputation.
Loss of customers.
Cost of investigating and recovering from attacks.

3. Are there existing measures that mitigate these threats?

Yes. An online holiday booking company could already have several security measures in place:

Firewalls to block unauthorised network traffic.
HTTPS/SSL encryption to protect information transferred between customers and the website.
Strong passwords to reduce the risk of account compromise.
Multi-factor authentication (MFA) for customer and employee accounts.
Access controls to ensure employees can only access information required for their job.
Antivirus and anti-malware software to protect company devices.
Regular backups to recover data after accidental loss or ransomware.
Security monitoring and logging to identify suspicious activity.
Payment security to protect customers' financial information.
Employee security training to reduce phishing and human-error risks.

4. What additional security measures could be implemented?

The company could improve its security by implementing:

Web Application Firewall (WAF) – helps protect the booking website against attacks such as SQL injection.
Regular penetration testing – identifies weaknesses before attackers can exploit them.
Stronger MFA – particularly for administrators and employees with access to sensitive information.
Encryption of stored data – protects customer information even if the database is compromised.
Advanced fraud detection – identifies unusual payment and booking activity.
Regular security audits – checks whether security policies and controls are working effectively.
Principle of least privilege – employees should only have access to the information necessary for their role.
Incident response plan – gives the organisation a clear procedure for responding to cyberattacks.
Regular employee training – helps staff recognise phishing, social engineering and other threats.

Re: Group 4 - A restaurant self-service digital ordering system (Alex, Crystal & Oleks))

Tue, 06 Oct 2026 11:47:29 GMT

by Oleksii Chepurnyi.

Key Discussion Points in our group 4.

Critical Threats: Payment data breaches and kiosk outages during peak service times.

Impact to our business: Financial penalties , lost revenue, brand damage, and wrong orders for customers.