Mediaspace scheduled maintenance: Aug 25, 2026 07:00 - 12:00 AM. During this time, videos will be temporarily unavailable. Check status updates.

Lecture

Adversarial Thinking: Common Weaknesses Enumeration

In course

COM-301: Computer security and privacy

This is an introductory course to computer security and privacy. Its goal is to provide students with means to reason about security and privacy problems, and provide them with tools to confront them. ...

Description

This lecture delves into adversarial thinking and attacks, focusing on the Common Weaknesses Enumeration (CWE) and the Common Vulnerability Scoring System. It covers weaknesses arising from non-sanitized data between components, unsanitized inputs on critical components, and ineffective defenses. The CWE Top 25 list is explored, highlighting prevalent weaknesses like improper input validation, out-of-bounds reads/writes, and exposure of sensitive information. The lecture emphasizes the importance of understanding and mitigating these vulnerabilities to enhance system security.

Instructors (2)

Carmela González Troncoso

Edouard Bugnion

Edouard Bugnion joined EPFL in 2012, where his focus is on datacenter systems. His areas of interest include operating systems, datacenter infrastructure (systems and networking), and computer architecture. Before joining EPFL, Edouard spent 18 years in the US, where he studied at Stanford and co-founded two startups: VMware and Nuova Systems (acquired by Cisco). At VMware from 1998 until 2005, he played many roles including CTO. At Nuova/Cisco from 2005 until 2011, he helped build the core engineering team and became the VP/CTO of Ciscos Server, Access, and Virtualization Technology Group, a group that brought to market Ciscos Unified Computing System (UCS) platform for virtualized datacenters. Prof. Bugnion is a Fellow of the ACM. Together with his colleagues, he received the ACM Software System Award for VMware 1.0 in 2009. His paper Disco: Running Commodity Operating Systems on Scalable Multiprocessors" received a Best Paper Award at SOSP '97 and was entered into the ACM SIGOPS Hall of Fame Award in 2008. At EPFL, he received the OSDI 2014 Best Paper Award for his work on the IX dataplane operating system

Official source

Related concepts (32)

Vulnerability (computing)

Vulnerabilities are flaws in a computer system that weaken the overall security of the device/system. Vulnerabilities can be weaknesses in either the hardware itself, or the software that runs on the hardware. Vulnerabilities can be exploited by a threat actor, such as an attacker, to cross privilege boundaries (i.e. perform unauthorized actions) within a computer system. To exploit a vulnerability, an attacker must have at least one applicable tool or technique that can connect to a system weakness.

Computer security

Computer security, cyber security, digital security or information technology security (IT security) is the protection of computer systems and networks from attacks by malicious actors that may result in unauthorized information disclosure, theft of, or damage to hardware, software, or data, as well as from the disruption or misdirection of the services they provide. The field is significant due to the expanded reliance on computer systems, the Internet, and wireless network standards such as Bluetooth and Wi-Fi.

Vulnerability management

Vulnerability management is the "cyclical practice of identifying, classifying, prioritizing, remediating, and mitigating" software vulnerabilities. Vulnerability management is integral to computer security and network security, and must not be confused with vulnerability assessment. Vulnerabilities can be discovered with a vulnerability scanner, which analyzes a computer system in search of known vulnerabilities, such as open ports, insecure software configurations, and susceptibility to malware infections.

Information sensitivity

Information sensitivity is the control of access to information or knowledge that might result in loss of an advantage or level of security if disclosed to others. Loss, misuse, modification, or unauthorized access to sensitive information can adversely affect the privacy or welfare of an individual, trade secrets of a business or even the security and international relations of a nation depending on the level of sensitivity and nature of the information. This refers to information that is already a matter of public record or knowledge.

Classified information

Classified information is material that a government body deems to be sensitive information that must be protected. Access is restricted by law or regulation to particular groups of people with the necessary security clearance and need to know, and mishandling of the material can incur criminal penalties. A formal security clearance is required to view or handle classified material. The clearance process requires a satisfactory background investigation.

Related lectures (29)

Cybersecurity: Threat Modeling and Solutions

Explores cybersecurity fundamentals, threat modeling, real-world case studies, and digital forensics procedures.

Cybersecurity: Vulnerabilities and Exploits

Explores cybersecurity vulnerabilities, exploits, and attacks, including nation agent motivations, vulnerability types, exploit processes, and phishing tactics during crises.

Computer Security: Basics and Vocabulary

Introduces computer security basics, properties, policy, threat modeling, and key vocabulary for adversarial thinking.

Personal Devices: Security and Privacy

Explores security and privacy issues in personal electronic devices, emphasizing the importance of safeguarding Personally Identifiable Information.

Security Principles: Work Factor & Compromise Recording