MSc Software & Cybersecurity

Faculty of Information and Communication Technology · CDU-ICT-SEC-900 · MSc · v1.0.0

The numbers a security engineer is asked for: the CVSS v3.1 base score and severity of a vulnerability, the entropy and exhaustive-search time of a memorised secret, annualised loss expectancy and the return on a security control, and the probability of a collision among n hashes of b bits.

Lineage

Conquest Designer University, 2026 — authored from the brief, CSEC2017 and the FIRST/NIST standards; no prior institution is claimed

Final research project

Quantifying exposure: severity, secret strength, expected loss and collision risk as engineering numbers

Syllabus

Vulnerability management: CVSS v3.1 base metrics, scope, the Roundup rule, severity bands
Authentication: keyspace, entropy, offline guessing rates, length minimums (NIST SP 800-63B)
Risk: single loss expectancy, annualised rate of occurrence, ALE, ROSI (NIST SP 800-30 Rev. 1)
Cryptography: the birthday bound, collision resistance of b/2 bits (NIST SP 800-107 Rev. 1)

Reference

CVSS v3.1 base: ISS = 1 − (1−C)(1−I)(1−A); impact 6.42·ISS (unchanged) or 7.52·(ISS−0.029) − 3.25·(ISS−0.02)^15 (changed); exploitability 8.22·AV·AC·PR·UI
CVSS severity: 0 none; 0.1–3.9 low; 4.0–6.9 medium; 7.0–8.9 high; 9.0–10.0 critical
Entropy: length × log2(alphabet size) for a uniformly random secret
ALE: SLE × ARO, SLE = asset value × exposure factor; ROSI = (ALE before − ALE after − cost) ÷ cost
Birthday bound: P(collision) ≈ 1 − exp(−n(n−1) ÷ 2^(b+1)); 50% at ≈ 1.1774·2^(b/2)

Units

CVSS v3.1 base score · Secret entropy and exhaustive-search time · Annualised loss expectancy and return on security investment · Birthday-bound collision probability

Role when narrated: You are a security engineer briefing an engineering lead. State the standard and the assumption, show the computation, and say what should be patched, configured or funded first.

CVSS v3.1 base score · cvss31_base

Try with the example

What base score and severity does this vulnerability’s CVSS v3.1 vector give?

Reference: FIRST CVSS v3.1 Specification §7 (base equations) and Appendix A (Roundup); severity rating scale §5

Returns

vector: The CVSS:3.1 vector string
baseScore: 0.0–10.0
severity: None, Low, Medium, High or Critical

The example

{
  "AV": "N",
  "AC": "L",
  "PR": "N",
  "UI": "N",
  "S": "U",
  "C": "H",
  "I": "H",
  "A": "H"
}

Agents: POST /faculty/msc-software--cybersecurity/cvss31_base with JSON {pan, …inputs} and the x-402-payment header. Manifest.

Secret entropy and exhaustive-search time · password_keyspace

Try with the example

How many bits of entropy does a random secret of this length and alphabet have, and how long would an offline attacker need to exhaust it?

Reference: NIST SP 800-63B (Rev. 3) §5.1.1 memorised secrets, minimum length 8 (check the revision in force); entropy of a uniformly random string = L·log2(N)

Returns

entropyBits: L·log2(N)
log10Keyspace: log10(N^L)
log10YearsToExhaust: log10 of the years to try every secret
meetsMinimumLength: Length ≥ the minimum

The example

{
  "length": 12,
  "alphabetSize": 62,
  "guessesPerSecond": 10000000000,
  "minimumLength": 8
}

Agents: POST /faculty/msc-software--cybersecurity/password_keyspace with JSON {pan, …inputs} and the x-402-payment header. Manifest.

Annualised loss expectancy and return on security investment · ale_rosi

Try with the example

What loss does this threat cost a year, before and after the control, and does the control pay for itself?

Reference: NIST SP 800-30 Rev. 1 (likelihood × impact); ISC² CISSP CBK quantitative risk analysis (SLE, ARO, ALE); Sonnenreich, Albanese & Stout (2006) ROSI

Returns

singleLossExpectancy: Asset value × exposure factor
aleBefore: SLE × ARO before
aleAfter: SLE × ARO after
rosi: (ALE before − ALE after − cost) ÷ cost

The example

{
  "assetValue": 2000000,
  "exposureFactor": 0.35,
  "annualRateBefore": 0.5,
  "annualRateAfter": 0.1,
  "annualControlCost": 90000
}

Agents: POST /faculty/msc-software--cybersecurity/ale_rosi with JSON {pan, …inputs} and the x-402-payment header. Manifest.

Birthday-bound collision probability · birthday_collision

Try with the example

Among this many hashed items, how likely is at least one collision, and at what count does it reach 50%?

Reference: The birthday bound; NIST SP 800-107 Rev. 1 §4.1 — collision resistance of an L-bit hash is at most L/2 bits

Returns

collisionProbability: 1 − exp(−n(n−1) ÷ 2^(b+1))
itemsFor50Percent: √(2·ln 2·2^b)
securityBits: b ÷ 2

The example

{
  "hashBits": 64,
  "items": 1000000000
}

Agents: POST /faculty/msc-software--cybersecurity/birthday_collision with JSON {pan, …inputs} and the x-402-payment header. Manifest.