{"slug": "build-to-break-your-guide-to-cybersecurity-at-hacktoberfest-hackday-x-owasp-jis", "title": "Build to Break: Your Guide to Cybersecurity at Hacktoberfest HackDay x OWASP JIS Univerity", "summary": "A guide for the Hacktoberfest Hack Day Kolkata x OWASP JIS University hackathon outlines how participants should build focused cybersecurity projects, from secret scanning and IAM privilege-escalation analysis to detection engines, and recommends giving open-weight models like Gemma a bounded role such as explaining detections or recommending remediation. It advises treating AI output as untrusted input that must be validated before any controlled action, and stresses demonstrating real attack scenarios rather than only happy paths.", "body_md": "Welcome to [Hacktoberfest Hack Day Kolkata x OWASP JIS University](https://events.mlh.com/events/14953-hacktoberfest-hack-day-kolkata-x-owasp-jis-university) 💖\n\nBuild a project that solves a real cybersecurity problem.\n\nYour project can focus on application security, cloud security, AI security, authentication, supply-chain security, detection and response, DevSecOps, or another security challenge.\n\nYou don't need to build a complete enterprise security platform. **Pick one meaningful problem, build a focused solution, and demonstrate that it works.**\n\nHere are some areas to explore:\n\nThese are starting points, not restrictions. **If you have a different cybersecurity idea, build it.**\n\nA simple way to structure a cybersecurity project is:\n\n```\n┌──────────────┐\n│   Problem    │\n└──────┬───────┘\n       ↓\n┌──────────────┐\n│    Attack    │\n└──────┬───────┘\n       ↓\n┌──────────────┐\n│Security      │\n│Control       │\n└──────┬───────┘\n       ↓\n┌──────────────┐\n│ Demonstrate  │\n│   & Test     │\n└──────────────┘\n```\n\nAsk:\n\n**What are you trying to protect, and what are you protecting it from?**\n\nFor example:\n\n**Problem:** Exposed API credentials can be used to access sensitive resources.\n\n**Attacker:** Someone who obtains a leaked credential.\n\n**Impact:** Unauthorized access to data or services.\n\nBefore building the solution, understand how the attack actually happens.\n\nThink about:\n\n**Attacker → Attack Vector → Vulnerability/Weakness → Impact**\n\n```\nAttacker\n   │\n   ▼\nStolen API Key\n   │\n   ▼\nUnauthorized API Access\n   │\n   ▼\nSensitive Data Exposure\n```\n\nYour project should intervene somewhere in this attack path.\n\nYour project should **do something about the security problem**.\n\n```\nSource Code\n    │\n    ▼\nSecret Scanner\n    │\n    ▼\nCredential Detected\n    │\n    ▼\nAlert / Block Commit\n```\n\nOr:\n\n```\nIAM Policy\n    │\n    ▼\nPermission Analysis\n    │\n    ▼\nPrivilege Escalation Path\n    │\n    ▼\nFinding + Remediation\nSecurity Logs\n    │\n    ▼\nDetection Engine\n    │\n    ▼\nSuspicious Activity\n    │\n    ▼\nAlert / Investigation\n```\n\nThe goal isn't to have the most features. **A focused security control that works is more valuable than a large collection of unfinished features.**\n\nIf you're using **Gemma or another open-source/open-weight model**, give the model a meaningful role in your system.\n\n```\nSecurity Detection\n       │\n       ▼\n     Gemma\n       │\n       ▼\nExplanation / Correlation\n       │\n       ▼\nRemediation Recommendation\n```\n\nGood uses for AI include:\n\nTreat model output as **untrusted input**, especially if it generates:\n\nPrefer:\n\n```\nAI Output\n    │\n    ▼\nValidation\n    │\n    ▼\nControlled Action\n```\n\nrather than:\n\n```\nAI Output\n    │\n    ▼\nProduction\n```\n\nDon't only demonstrate the happy path.\n\nTry to break your own system.\n\nAt minimum, test:\n\n```\nNormal Prompt\n     ↓\n   Works\n\nMalicious Prompt\n     ↓\nInjection Detected\n     ↓\n   Blocked\nVulnerable Policy\n       ↓\nPrivilege Escalation\n       ↓\n     Detected\n       ↓\nRemediation Suggested\nLeaked Credential\n       ↓\n    Detected\n       ↓\nCommit Blocked\n       ↓\nDeveloper Alerted\n```\n\nA cybersecurity project should be demonstrated with an actual security scenario.\n\nA simple structure is:\n\n**Attack → Detection/Prevention → Result**\n\nDon't just show a dashboard and say:\n\n\"Our system detects attacks.\"\n\nShow the attack.\n\nShow what your system detects or prevents.\n\nShow the result.\n\nAvoid making claims that you cannot demonstrate.\n\nInstead of:\n\n\"Our system completely prevents phishing.\"\n\nExplain what your system actually does:\n\n\"Our system detects suspicious websites using URL, DOM and visual features.\"\n\n\"Our AI guarantees secure code.\"\n\nSay:\n\n\"Our AI identifies potential security issues and suggests remediation.\"\n\nIf you report metrics such as accuracy, explain how you measured them.\n\n[OWASP Top 10:2025](https://top10.owasp.org/2025/)\n\nA starting point for understanding common application-security risks and finding project ideas.\n\n[OWASP Top 10 for LLM Applications](https://genai.owasp.org/llm-top-10/)\n\nUseful for projects involving LLMs, GenAI, AI agents, or open-source models.\n\n[OWASP Cheat Sheet Series](https://cheatsheetseries.owasp.org/)\n\nPractical implementation guidance for common security topics.\n\n[OWASP API Security Top 10](https://owasp.org/API-Security/)\n\nUseful if your project involves APIs, authentication, authorization, or access control.\n\n[OWASP Web Security Testing Guide](https://owasp.org/www-project-web-security-testing-guide/)\n\nUse this to test your web application before submission.\n\n[OWASP GSoC Project Ideas](https://community.owasp.org/initiatives/gsoc/gsoc2026ideas)\n\nExplore real OWASP open-source projects and technical problem areas for additional inspiration.\n\n[OWASP Project Directory](https://owasp.org/projects/)\n\nBrowse existing OWASP projects across application security, AI security, cloud security, tooling, and more.\n\nThese are provided for **inspiration and further exploration**. You do not need to contribute to an existing OWASP project for the Hackday.\n\nBefore submitting, ask yourself:\n\n**Problem → Attack → Security Control → Test → Result**\n\nYou don't need to build the next enterprise security platform.\n\n**Pick one real security problem. Understand it. Build a focused solution. Try to break it. Then demonstrate that your solution works.**", "url": "https://wpnews.pro/news/build-to-break-your-guide-to-cybersecurity-at-hacktoberfest-hackday-x-owasp-jis", "canonical_source": "https://dev.to/arceuzvx/build-to-break-your-guide-to-cybersecurity-at-hacktoberfest-503b", "published_at": "2026-09-27 12:34:08+00:00", "updated_at": "2026-09-27 13:01:06.841920+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "developer-tools"], "entities": ["Hacktoberfest", "OWASP", "JIS University", "Gemma", "OWASP Top 10", "OWASP Top 10 for LLM Applications"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/build-to-break-your-guide-to-cybersecurity-at-hacktoberfest-hackday-x-owasp-jis", "markdown": "https://wpnews.pro/news/build-to-break-your-guide-to-cybersecurity-at-hacktoberfest-hackday-x-owasp-jis.md", "text": "https://wpnews.pro/news/build-to-break-your-guide-to-cybersecurity-at-hacktoberfest-hackday-x-owasp-jis.txt", "jsonld": "https://wpnews.pro/news/build-to-break-your-guide-to-cybersecurity-at-hacktoberfest-hackday-x-owasp-jis.jsonld"}}