Week 2, Lecture 2 — Frameworks Worth Knowing

Cybersecurity & Secure Programming

Slot: W2 L2 Content budget: 30 min + two 3-min interludes Embedded interlude: 3 min OWASP A02 CWE list + 3 min ATT&CK Navigator on FIN7 Anchors: CVE funding cliff 15 Apr 2025, FIN7/ATT&CK v18.1 Book chapter: 5

Before the lecture

Read Chapter 5 — Frameworks Worth Knowing in the book PDF (approximately 16 pages, 35 minutes reading time). The chapter opens on the 15 April 2025 CVE Programme funding cliff — the morning MITRE wrote to the CVE Board to say the contract was not being renewed — and uses FIN7 walked through ATT&CK v18.1 as the worked example that makes the matrix concrete. Skim the framework tour itself; spend your re-read on the three-families distinction and the picking guide.

Slides

Lecture timing

A 50-minute slot is realistically 45–50 minutes of room time. 30 min of content + two 3-min embedded interludes + 5–10 min slack for arrivals, transitions, and Q&A. The framework tour is wide and tempting to over-deliver; resist.

Block Time Notes
Opening — CVE 2025 funding scare + three-families diagram 0–5 min The cleanest illustration of why frameworks are infrastructure, not abstractions
OWASP family overview 5–10 min Top 10:2025 framing, brief LLM Top 10 sign-post, ASVS / Cheat Sheets / ZAP-rebrand watch-out in passing
Embedded interlude A — live OWASP A02 CWE list 10–13 min See script below
MITRE family 13–20 min CVE/CWE distinction, ATT&CK overview, FIN7 walk-through
Embedded interlude B — ATT&CK Navigator on FIN7 20–23 min See script below
Governance whistle-stop 23–30 min CSF 2.0, ISO 27001, CIS Controls, NIS2, DORA, Cyber Essentials, PCI DSS, SOC 2 — name and one-line each
The opinionated picking guide 30–36 min The keeper. Cyber Essentials Plus → SOC 2 Type II → ISO 27001 only when asked

If you run short, drop OWASP Mobile Top 10 (name only), CAPEC (one-sentence mention), D3FEND (one line), and the PCI DSS / SOC 2 budget figures. Keepers under any budget: three-families diagram, CVE/CWE distinction, ATT&CK FIN7 walk-through, picking guide.

Embedded interlude A — live OWASP A02 CWE list (~3 min)

URL. https://owasp.org/Top10/A02_2021-Cryptographic_Failures/

Setup. “Open this. Look at the very top of the page.”

Activity. Students see the CWEs Mapped block — roughly 29 separate CWE IDs feeding into this single OWASP category.

Talking points.

  • One Top 10 risk maps to many CWE weaknesses.
  • OWASP is curation; CWE is taxonomy. They are complementary, not duplicates.
  • This is why “I’m OWASP-compliant” is a meaningless phrase — it answers a different question than “have we addressed CWE-XXX?”

Wrap. “OWASP gives you priorities. CWE gives you the underlying inventory. You need both.”

Embedded interlude B — ATT&CK Navigator on FIN7 (~3 min)

URL. https://attack.mitre.org/groups/G0046/

Setup. “Open the FIN7 group page. Scroll to Techniques Used.”

Activity. Students see the list of techniques attributed to FIN7 across the ATT&CK kill chain.

Talking points.

  • This is real adversary behaviour, codified.
  • Note the spread across tactics — Initial Access, Execution, Persistence, Defence Evasion, Exfiltration. A real APT walks the matrix; they do not specialise in one column.
  • Each technique has its own page with detection guidance — that is what defenders use.
  • Ask: “If you were defending against FIN7, which technique would you instrument first?” Take answers; there is no clean answer (that is the point).

Wrap. “ATT&CK is a vocabulary for what adversaries actually do. CVE/CWE is a vocabulary for what code actually has wrong with it. The two together are how the modern security operations centre describes its world.”

Tip

Pre-lecture link check. Two minutes before class, click each link below and confirm it loads. OWASP and MITRE both restructure URLs occasionally; better to know now than to fumble live.

Common student questions (and short answers)

  • “Aren’t OWASP Top 10 and CWE Top 25 just two names for the same list?” — No, and conflating them is a tell that the speaker has read neither. OWASP Top 10 is an awareness list of risk categories in web applications, ranked by prevalence in app-testing data. CWE Top 25 is a list of weakness types across all software, ranked by a formula combining frequency in the NVD and CVSS severity. There is overlap (XSS, SQLi appear in both) but the lists answer different questions.
  • “Is ATT&CK a threat-modelling methodology?” — No — it is a library. ATT&CK does not tell you how to do threat modelling; it gives you a structured catalogue of what real adversaries do, which you then feed into a methodology (STRIDE, the Four-Question Frame from Chapter 4, PASTA). This misconception is the one that slips into job adverts and vendor pitch decks.
  • “Should our 30-person SaaS just go straight for ISO 27001?” — Almost certainly not. For a fifteen-to-thirty-person Irish SaaS without a regulated customer pulling them by name, ISO 27001 first is over-engineered, over-budgeted, and slow to produce value. The pattern that works is Cyber Essentials Plus → SOC 2 Type II → ISO 27001 only when a customer asks for it by name. Many companies eventually run ISO 27001 + SOC 2 in parallel, mapping the same controls to both, but that is a Year-3 problem, not a Year-1 problem.
  • “Is NVD still reliable as a CVE enrichment source?” — As of April 2026, only for CVEs in CISA’s KEV catalogue, in software used by the US federal government, or covered by EO 14028. Everything else is flagged “lowest priority” and relies on CNA-supplied scores. Defenders building dissertation pipelines that assume NVD enrichment of every CVE will be surprised.

End-of-lecture self-check

Optional, formative — not graded. Click an option to see immediate feedback.

Going Further

← Schedule ← Previous: W2 L1 Next: Week 2, Practical →