Criterion	LO	Guide
Security analysis	1	S2 · S3 interface table · S4 threat/attacker model
Data security	2	S5 asset list · S7 shell matrix
C/C++ hardening and RASP	3	S9 (basic) · S10
Project management	5	S13 process, SBOM · GitHub repo and plan
Interim report	7	All midterm sections

Complete	Draft / brief / plan
S0 cover · S2 overview · S3 architecture · S4 threat model	S1 scope (draft) · S5 assets (draft)
S7 data security · S10 RASP · S13 process	S9 hardening (basic) · S12 reporting (brief)
	S16 testing (plan) · S17 compliance matrix (draft)

Week	What you should be able to show
1	Repo + plan · S2 · S3 interface table · S4 STRIDE + attack tree · S5 draft (C/I/I+)
2	Every threat → CWE + CVSS v3.1 vector
3	S7 algorithm/key/binding · shell matrix · CSPRNG · AEAD verification
4	S9 protection table · CERT findings · ASan+UBSan · fuzz result
5	SBOM + scan · input validation table
6	S10 RASP inventory · response policy · a bypass attempt

CEN429 Secure Programming · Week 7

Sample Questions

Which flow crossing a trust boundary is the riskiest?
How long does this asset stay unencrypted in memory, and where is it wiped?
Where does the key come from, where does it live, when is it deleted? Can the nonce repeat?
Which compiler protection is turned off, and why?
What happens when a RASP check fails?
Does the SBOM contain a vulnerable component? Are you affected?
What are your three most critical assets, their C/I/I+ labels, and their lifecycle?
Which control addresses a given threat, and how was it verified? (threat → control → evidence)
What is your remaining risk, and why is it acceptable? (answer honestly and with justification)

Mistake	Why is it a problem?
Guide and code are inconsistent	One of the most serious findings
"Secure" claimed without evidence	Not scored
Keys/logs/code missing from the asset list	What is not in the list is not protected
Threat table from general knowledge	Project-specific threats get missed
Unrehearsed demonstration	Time is wasted
Real password/key/personal data in the repo	A serious security mistake; values must be synthetic
Live demo crashes with no backup / remaining-risk section left empty	Looks like a lack of preparation and honest analysis

Midterm Project Demonstrations