DEV Community: Sujala Vasanthasena Nelavai

Cybersecurity Meets Patient Safety: Building an ECG STRIDE Threat Model

Sujala Vasanthasena Nelavai — Thu, 06 Aug 2026 12:29:11 +0000

**The purpose of this light version threat model is to demonstrate how STRIDE can be applied to an ECG device. It is intended for readers learning system decomposition and threat modelling techniques. The example includes a simplified set of components, threats, and mitigations for educational purposes and is not intended to represent a comprehensive medical device cybersecurity assessment or any regulatory submission.
**Assumption: This example models a typical ECG device, which may include network connectivity in a clinical environment.
Trust Boundaries: Trust boundaries exist between the ECG device, hospital network, and external clinical systems.

System Definition:

ECG is the abbreviation for an Electrocardiogram. It is used to detect electrical activity of the heartbeat in the form of P wave, QRS complex and T wave to identify and diagnose irregularities in heartbeat. Electrodes are placed on patient’s limbs and chest to measure the electrical potentials. It translates tiny electrical signals into digital wave patterns. These waveforms are used by the doctors to evaluate the heart rhythm and check for cardiac damage.

Components

• Electrodes
• Lead wires
• Amplifier and filters
• Analogue-to-Digital Converter (ADC)
• Main processing unit
• Display/printer
• Local storage
• Network interface (Ethernet/Wi-Fi/Bluetooth), if supported.

Data Flow Diagram:

Electrodes → Lead wires → Amplifier and filters → Analogue-to-Digital Converter (ADC) → Main processing unit → Display / Printer / Local storage / Network interface (if supported) |TRUST BOUNDARY|→ Electronic Health Record (EHR) / Clinical Information System

2. STRIDE Threats:

Threats Description

Spoofing in general ** - Spoofing is the act of impersonating a legitimate user, device, or system to gain unauthorized access to resources or services. Violates authentication.
*Spoofing in ECG * - An attacker may impersonate an authorized clinician, connected medical device, or trusted clinical system to gain unauthorized access to the ECG device or associated patient data.
*Tampering in general *- Tampering is the unauthorized manipulation of data, software, firmware, or system configuration. Violates integrity.
*Tampering in ECG * - Manipulation of ECG signals, configuration, firmware, or stored ECG data which may lead to false-negative or false-positive diagnoses, thereby leading to incorrect medication or delayed care.
*Repudiation in general * - Repudiation occurs when users deny performing actions due to unavailability of sufficient audit evidence. Violates non-repudiation.
*Repudiation in ECG *- Insufficient audit logs prevent accountability for configuration changes or user actions.
**Information Disclosure in general - Information Disclosure is the unauthorized exposure of confidential or sensitive information. Violates confidentiality.
Information Disclosure in ECG - Insecure storage or communication may expose ECG data or patient identifiers.
Denial of Service in general ** - Denial of Service prevents a system from performing its intended function by making its resources or services unavailable. It may result from resource exhaustion, software crashes, hardware failures, protocol abuse, or malicious requests. Violates availability.
**Denial of service in ECG - Device or network disruption prevents ECG acquisition, processing, or monitoring.
Elevation of Privilege in general - Elevation of Privilege occurs when an attacker gains permissions beyond those originally assigned. Violates authorization

Elevation of Privilege in ECG - Attackers obtain unauthorized administrative or firmware-level access.

3. Mitigations

(Aligned with OWASP Threat Modeling cheat sheet, OWASP Threat Modeling project resources, NIST SP 800-53 Rev. 5, ISO/IEC 27001)
• Recommend strong authentication and role-based access control.
• Data encryption in transit and at rest.
• Secure boot and digitally signed firmware.
• Verification of integrity for firmware and stored ECG data.
• Audit logging for user access and configuration changes.
• Disable unnecessary services and interfaces.
• Segmentation of network for connected ECG devices.
• Authenticated and integrity-protected software updates.
• Monitoring for abnormal access or device behavior.

4. Validation Checklist
**
• All system components and data flows are identified.
• Each STRIDE category is represented by at least one relevant threat.
• Every threat has a corresponding mitigation.
• Security controls are feasible for typical ECG devices.
• Patient safety impacts have been considered.
• Threats and mitigations are internally consistent.
**REFERENCES:
• OWASP Threat Modeling Cheat Sheet
• OWASP Threat Modeling Project
• NIST SP 800-53 Rev. 5
• ISO/IEC 27001
• MITRE Playbook for Threat Modeling Medical Devices

Your Mind Is the First System Hackers Can Exploit

Sujala Vasanthasena Nelavai — Sun, 21 Jun 2026 11:41:23 +0000

Why Cybersecurity Must Start With the Analyst — Not the Attack**

1. The Breach No One Talks About

Before a misconfiguration happens… Before an alert is misread… Before a threat is escalated or dismissed…
Something else is already compromised: the analyst’s clarity.

Cybersecurity doesn’t start with SIEM dashboards. It starts with the state of mind interpreting them.

2. The Hidden “Mind Threats” Undermining Cyber Defence
Every analyst faces internal threats that distort judgement:

• Cognitive Overload — too many alerts, too little bandwidth
• Pattern Hypervigilance — seeing threats everywhere
• Emotional Hijacking — urgency overriding logic
• Bias Driven Interpretation — anchoring, tunnel vision, confirmation bias
• Fatigue Blind Spots — exhaustion disguised as competence
These are not personal flaws. They are biological responses to relentless vigilance.

When the Mind Slips, the System Follows A compromised mental state leads to: • false positives • missed anomalies • rushed escalations • flawed triage • poor threat prioritisation Not because the analyst lacks skill — but because their internal threat surface was already breached.
The Early Warning Signs of Cognitive Drift You know your system logs. But do you know your mental logs? Watch for: • shallow breathing • fixation on one hypothesis • irritability or urgency • skipping verification steps • rechecking the same data repeatedly These are not inconveniences — they are pre incident indicators.

5. The Analyst’s Mental Firewall: Grounding Techniques That Work To secure the mind before securing the system:

• Sensory Grounding: anchor attention in the present
• Breath Reset: slow exhale to calm the nervous system
• Micro Pauses: 3 seconds between triage steps
• Mental Air Gap: a deliberate pause before critical decisions
Small resets prevent catastrophic mistakes.

6. The Future of Cybersecurity Is Cognitive
The next era of defence will prioritise:
• human centred security
• cognitive resilience
• mindful analysis
• psychologically safe teams
Tools evolve. Threats evolve. But the analyst remains the final firewall.

7. Final Thought
Before you secure systems, secure the mind that protects them. A clear mind sees threats accurately. A grounded mind responds intelligently. A resilient mind protects more than data — it protects the integrity of the digital world.
Used wisely, the mind is a guardian. Used poorly, it becomes a gap in the firewall. Hackers know this — the mind is always the first system they try to exploit.

Secure the mind. Secure the system. Secure the future.

What mental pitfalls have you noticed in your own analysis work?

"MFA isn’t as safe as you think — here’s what I learned about Tycoon’s bypass techniques today."

Sujala Vasanthasena Nelavai — Wed, 17 Jun 2026 13:35:19 +0000

Sujala Vasanthasena Nelavai

May 27

What I Learned Today About MFA Bypass Techniques (Tycoon Kit)

#socanalyst #security #infosec #webdev

1 min read

"An architectural deep-dive drawing a powerful parallel between biological genetic diversity and cybersecurity, warning against the silent rise of digital monocultures accelerated by AI."

Sujala Vasanthasena Nelavai — Fri, 12 Jun 2026 10:46:11 +0000

Sujala Vasanthasena Nelavai

Jun 3

Genetic Diversity and Cyber Diversity: Why Monocultures Are Dangerous in Both Worlds

#devsecops #security #architecture #ai

3 min read

"A deeply researched exploration into the psychology of a defender, analysing how 'Pattern Hypervigilance' acts as both a superpower and a hidden burnout hazard for SOC analysts."

Sujala Vasanthasena Nelavai — Fri, 12 Jun 2026 10:29:54 +0000

Sujala Vasanthasena Nelavai

May 26

The Hypervigilance Trap: Why SOC Analysts Miss Threats When They Try Too Hard

#discuss #socanalyst #security #productivity

4 min read

A unique, analytical write-up connecting the logic and precision of AI training directly to core cybersecurity principles like threat analysis and documentation.

Sujala Vasanthasena Nelavai — Fri, 12 Jun 2026 10:24:20 +0000

Sujala Vasanthasena Nelavai

May 21

What AI Training Taught Me About Clear Technical Thinking — And Why It Matters in Cybersecurity

#security #ai #career #infosec

2 min read

A practical guide on leveraging GitHub Copilot to identify and fix OWASP Authentication vulnerabilities for the Finish-Up-A-Thon challenge.

Sujala Vasanthasena Nelavai — Fri, 12 Jun 2026 10:18:30 +0000

GitHub “Finish-Up-A-Thon” Challenge Submission

Sujala Vasanthasena Nelavai

Jun 4

Improving My OWASP Authentication Failures Write‑Up Using GitHub Copilot

#devchallenge #githubchallenge #security #socanalyst

2 min read

The Turing Hinge & Solstice Entropy: A dual-Game Ode to Alan Turing

Sujala Vasanthasena Nelavai — Thu, 11 Jun 2026 12:18:26 +0000

This is a submission for the June Solstice Game Jam

What I Built

For this challenge, I explored the concept of the Solstice from two entirely contrasting design philosophies: Real-Time Operational Defense and Philosophical Narrative Decay. Rather than submitting a single static entry, I built a dual-game interactive experience:

The Turing Hinge (Zero-Day Solstice): A high-stakes cybersecurity triage simulator. You play as a SOC Analyst stuck at a temporal loop point during the peak of the June Solstice. With the past erased and the future locked, you must make real-time choices to defend the network using only the absolute present moment.
Solstice Entropy: A soft, meditative text adventure exploring the inevitable decay of systems, environments, and choices as the solstice sun crosses its absolute apex and begins its regression.

Play Both Games Instantly:

Project 1: The Turing Hinge

Project 2: Solstice Entropy

Game Interface Gallery

While a full video walk-through isn't included, both interactive games are fully running, stable, and completely playable directly via the CodePen embeds above. Below are structural snapshots of the user interfaces in action:

Code

Both games are written in pure HTML, CSS, and Vanilla JavaScript. Because they are designed to run instantly inside the browser without configuration, you can view the complete source logic and play with the code directly on my public CodePen repositories:

Development Workspace Snapshots

Below are structural snapshots of the codebase directly from the CodePen workspace environment:

1. The Turing Hinge Interface

![The Turing Hinge Terminal]

Features a retro-futuristic dark mode cyber-terminal theme with responsive neon glows mimicking a live SOC triage environment.

2. Solstice Entropy Interface

![Solstice Entropy Canvas]

Features an elegant glassmorphic interface with fluid, meditative gradient transitions tailored for introspective narrative choices.

How I Built It

These games balance each other technically and conceptually.

The Turing Hinge Engine: Built with raw state-machine logic in Vanilla JavaScript managing dynamic stage progression (currentStage). The UI mimics a high-security monitoring terminal leveraging high-contrast system alert colors (Success green, Critical red, Warning orange) to heighten tension.
Solstice Entropy Engine: Features a minimalist layout utilizing glassmorphic panels and fluid, slow CSS keyframe transitions (@keyframes fadeIn) to simulate an organic emotional canvas. It uses localized object state maps tracking interactive trajectory selections (playerPath), ensuring a personalized narrative conclusion.

Both mechanics force the user to interact purely with raw, present-moment triage logic or fluid intuition, bypassing historical telemetry entirely.

Expansion Module: The Biological Perspective

As an interactive extension to this submission, I created a third experience exploring the June Solstice through a biological and metabolic lens.

Instead of an astronomical or network defense mechanism, The Photoperiod Apex simulates a real-time Suprachiasmatic Nucleus (circadian core) crisis. Trapped inside the extreme, prolonged light of the solstice, players must manage biochemical feedback loops, ATP production spikes, and free radical neutralization to save a living biological system from cellular collapse.

Play The Photoperiod Apex Instantly:

Technical Engine: Built as a programmatic state machine mapping custom bio-chemical triage states via interactive DOM re-renders.
Ode to Turing Connection: This extension bridges to Alan Turing's monumental, lesser-known final work in Mathematical Biology (his theory of Morphogenesis), demonstrating how biological systems operate like intricate logical computing mechanisms fighting universal entropy.

Prize Category

I am submitting this project to the following category:

Best Ode to Alan Turing: The Turing Hinge is a direct homage to original computer science architecture. It heavily incorporates cryptographic themes, a simulated "Mimi-test" identity spoofing system, and features a final victory mechanism reliant on executing a "Universal Machine" script. The core design is inspired entirely by Turing’s famous observation: "We can only see a short distance ahead, but we can see plenty there that needs to be done."

Transparency note: I used AI- Google Gemini to generate the CodePen code for this challenge. The concept and design are my own. I am not a developer. A cybersecurity learner viewed this game in the cybersecurity, philosophical and Biological perspectives as I am transitioning from Biology teaching career to Cybersecurity.

Improving My OWASP Authentication Failures Write‑Up Using GitHub Copilot

Sujala Vasanthasena Nelavai — Thu, 04 Jun 2026 12:29:04 +0000

This is a submission for the GitHub Finish-Up-A-Thon Challenge

What I Built

I revisited and completed my OWASP Authentication Failures write‑up — a project I started months ago but never fully shaped into a clear, structured, SOC‑friendly resource.
The goal was to transform scattered notes into a polished, practical explanation of real‑world authentication weaknesses, mapped to OWASP guidance and enriched with detection engineering insights.

This project matters to me because authentication failures are one of the most common issues SOC analysts investigate, yet most explanations online are either too shallow or too theoretical. I wanted to create something genuinely useful for beginners and blue‑team learners. Provide an overview of your project, where it started, and what it means to you.

Demo

https://github.com/sujalavnelavai/Cybersecurity-Notes/blob/main/OWASP-Authentication-Failures/README.md
BEFORE SCREENSHOTS

AFTER SCREENSHOT

The Comeback Story

When I first created this folder, it only had a rough outline and a few bullet points. No structure, no examples, no SOC relevance — just a draft I kept postponing.

For the Finish‑Up‑A‑Thon, I:

rewrote the entire explanation in a clean, readable format

added real‑world authentication failure scenarios

included SOC detection examples (failed logins, brute force patterns, token misuse, session anomalies)

mapped the content to OWASP Top 10

improved clarity, flow, and technical accuracy

added practical notes on MFA, OAuth/SSO issues, and session management

reorganized everything into a proper Markdown document
The project went from “unfinished notes” to a complete, structured, educational write‑up that I can confidently share with other learners.
My Experience with GitHub Copilot
GitHub Copilot played a huge role in helping me finish this project:

It expanded short bullet points into clear explanations

Suggested better phrasing and transitions

Helped me structure the document logically

Made the writing more natural and readable

Supported me in adding SOC‑focused examples

Reduced the time I spent rewriting repetitive sections

Instead of staring at a blank page, I could iterate quickly, refine ideas, and focus on accuracy and clarity. Copilot felt like a writing partner that kept me moving forward.

Improving My OWASP Authentication Failures Write‑Up Using GitHub Copilot

Sujala Vasanthasena Nelavai — Thu, 04 Jun 2026 09:46:01 +0000

As part of the GitHub Copilot Challenge, I revisited one of my older cybersecurity notes on Authentication Failures and transformed it into a clear, structured, and SOC‑focused write‑up.

This challenge helped me improve my technical writing, organise my thoughts, and explain concepts in a more human, readable way.

*BEFORE GITHUB SCREENSHOTS:
*

AFTER GITHUB SCREENSHOTS:

What I Improved
I rewrote my entire explanation of authentication failures, focusing on:

Token leakage

Weak or missing MFA

Poor session management

Brute force & credential stuffing

Misconfigured OAuth / SSO

I also added SOC detection examples to make the content more practical and relevant for blue‑team work.

How GitHub Copilot Helped
GitHub Copilot supported me by:

Suggesting clearer explanations

Expanding short bullet points into meaningful content

Helping me structure the write‑up

Improving readability and flow

Encouraging a more human, natural tone

GitHub Repository
Here is the updated write‑up in my repo:

https://github.com/sujalavnelavai/Cybersecurity-Notes/blob/main/OWASP-Authentication-Failures/README.md

Final Thoughts
This challenge helped me understand authentication failures more deeply from a SOC and IAM perspective.
It also improved my documentation skills — something extremely important for cybersecurity roles.

I’m proud of the transformation and excited to continue building my cybersecurity learning notes.

Genetic Diversity and Cyber Diversity: Why Monocultures Are Dangerous in Both Worlds

Sujala Vasanthasena Nelavai — Wed, 03 Jun 2026 11:37:40 +0000

When I first learned about genetic diversity in biology, the idea felt simple: systems survive when they are diverse, and collapse when they are uniform.
Years later, when I stepped into cybersecurity, I realised something surprising — the same rule applies here too. Different domain, same truth. Different risks, same pattern.
And the more I observe AI driven development, cloud platforms, and modern SOC workflows, the more I see a quiet danger forming:
We are slowly drifting into digital monocultures.
And monocultures — whether biological or cyber — don’t fail slowly. They fail all at once.
1. What Biology Teaches Us About Monocultures
In nature, monocultures are fragile.
• One disease can wipe out an entire crop.
• One mutation can collapse a population.
• One environmental shift can erase a species that lacks variation.
The best example for Biological Monoculture is in 1840s Irish farmers relied on two genetically identical potato varieties. Later a water mold called Phytophthora infestans caused a severe potato blight which led to the destruction of the harvest.
Diversity isn’t a luxury. It’s a survival mechanism.
Genetic variation gives a species:
• adaptability
• resilience
• multiple ways to respond to threats
Without it, the system becomes predictable — and predictability is vulnerability.
2. Cybersecurity Has Its Own Monocultures
We don’t call them that, but they exist everywhere:
Software monoculture is the major monoculture in the IT world.
• everyone using the same cloud provider
• everyone deploying the same frameworks
• everyone depending on the same AI models
• everyone copying the same architecture patterns
• everyone relying on the same “best practices”
When the entire industry moves in one direction, attackers don’t need creativity. They just need one exploit that works everywhere.
*Example of Cybersecurity Monocultures is: The Crowdstrike Global IT Outage (2024) *
When CrowdStrike pushed out a bad update to its Falcon sensor, it didn’t just break a few machines — it knocked out around 8.5 million Windows systems across the world. One tiny mistake in one widely used tool brought global IT to a standstill.
Why did it spread so far, so fast?
Because so many organisations were depending on the same EDR vendor (CrowdStrike), all running on the same operating system (Windows). That uniformity meant the failure didn’t stay local. It cascaded everywhere within hours.
This is what monoculture risk looks like in cybersecurity: one flaw → worldwide disruption.

A single vulnerability becomes a global incident.
We’ve seen this pattern:
• Log4j
• SolarWinds
• Heartbleed
• S3 misconfigurations
• supply chain attacks
One weak link → entire ecosystem shaken.
That’s the cyber version of a crop disease wiping out a field.
3. AI Is Accelerating Digital Monocultures
This is the part nobody talks about.
AI tools generate:
• similar code
• similar patterns
• similar abstractions
• similar mistakes
If millions of developers rely on the same models, the same prompts, the same agents…
We’re not just writing code. We’re creating uniform code.
Uniform code → uniform vulnerabilities.
AI is powerful, but it also compresses creativity if we let it think for us instead of with us.
And when creativity shrinks, diversity shrinks with it.
4. The Human Mind Is the Last Source of Diversity
This is where your thinking matters.
Diversity in cybersecurity doesn’t come from tools. It comes from:
• different mental models
• different ways of analysing threats
• different cognitive patterns
• different backgrounds
• different questions
• different instincts
AI can generate code, but it cannot generate your perspective.
It cannot replicate:
• your lived experience
• your intuition
• your pattern recognition
• your psychological insight
• your clarity of thought
This is why human creativity is not optional — it’s a security feature.
5. How We Build Cyber Diversity Intentionally
Here’s what real diversity looks like in cybersecurity:
• teams with different thinking styles
• architectures that avoid single points of failure
• codebases that aren’t AI generated clones
• threat models that consider human behaviour
• systems designed with multiple layers of reasoning
• analysts who question assumptions instead of copying patterns
Diversity is not chaos. It’s structured resilience.

The Final Parallel: Nature Survives Through Variation — So Should We Biology has had millions of years to teach us one lesson: Uniform systems break. Diverse systems adapt.

Cybersecurity is no different.
If we want resilient digital ecosystems, we need:
• diverse tools
• diverse architectures
• diverse thinking
• diverse people
• diverse approaches
• diverse mental models
And most importantly:
We need to protect the one thing AI cannot replace — human creativity.
Because in both genetics and cybersecurity, monocultures don’t die slowly. They die suddenly.

What I Learned Today About MFA Bypass Techniques (Tycoon Kit)

Sujala Vasanthasena Nelavai — Wed, 27 May 2026 19:42:55 +0000

I have been spending more time studying phishing and session‑hijacking techniques, and today I came across something that really caught my attention: the Tycoon MFA‑bypass kit.

I am still early in my cybersecurity journey, but this one made me rethink how attackers approach authentication systems.

From what I understood, Tycoon does not “break” MFA in the traditional sense.
It does something more subtle — it intercepts the session after the user authenticates.
So even though MFA is technically working, the attacker still gets in.

For me, the interesting part was not the tool itself, but the shift in attacker strategy.
It feels like the focus is moving away from stealing passwords and towards stealing active sessions and tokens.

As someone aiming for a junior SOC role, this was a good reminder that learning cybersecurity is not just about memorising tools or techniques. It is about understanding how attackers think, and how quickly their methods evolve.

I am still learning, still piecing things together — but this was a valuable insight from today’s study session.