Digital Literacy · Grade 11 · Chapter 1

Cybersecurity Fundamentals

From password entropy to Public Key Infrastructure and zero-trust security architecture.

Case Study

Cracked Live, On Stage

At a cybersecurity conference, an auditor takes a leaked hash database and demonstrates cracking a standard 8-character password P@ssword1 in 0.003 seconds using GPU cluster hashcat. The room gasps.

Discussion: Why did a password with numbers and symbols fall instantaneously while a 4-word passphrase correcthorsebatterystaple remains mathematically uncrackable?

Learning Objectives

What We Will Master Today

Analyze security systems using the CIA Triad (Confidentiality, Integrity, Availability)
Distinguish between Symmetric (AES) and Asymmetric (RSA/ECC) encryption
Understand Public Key Infrastructure (PKI), digital certificates, and TLS handshakes
Calculate password entropy and understand why salting & peppering stops rainbow tables
Identify modern attack vectors: Spear Phishing, Man-in-the-Middle (MitM), and SQL Injection

Prior Knowledge Connection

Basic Safety vs Systems Security

Grade 8-9 Mindset

Don't share passwords, don't talk to strangers, enable 2FA on social media, don't click unknown links.

Grade 11 CS Mindset

Understand cryptographic primitives, zero-trust network boundaries, authentication handshakes, and mathematical entropy of keys.

Core Pillar

The CIA Triad

Every security policy, security tool, or data breach is evaluated against three core objectives:

Confidentiality

Ensuring data is accessed ONLY by authorized users. Protected via encryption, access control (RBAC), and authentication.

Integrity

Ensuring data is accurate and untampered with. Protected via cryptographic hashing (SHA-256) and digital signatures.

Availability

Ensuring systems and data are accessible when needed. Protected via redundancy, backups, and DDoS mitigations.

Smartboard Analysis

Classify the Security Breach

Identify which element of the CIA Triad is violated in each scenario:

Scenario A: An attacker floods a school web portal with 50,000 requests/sec, causing the site to crash.
Scenario B: An insider modifies grades in the database without authorization.
Scenario C: Unencrypted student health records are leaked onto a public pastebin.

Cryptographic Primitives

Symmetric vs Asymmetric Encryption

Symmetric Encryption (AES-256)

Uses one single secret key for both encryption and decryption. Lightning fast! Great for encrypting hard drives & active session data.

The Key Exchange Problem

How do two strangers across the internet securely share that secret key without anyone intercepting it?

Asymmetric Encryption

Public Keys & Private Keys

Asymmetric algorithms (RSA, Elliptic Curve Cryptography - ECC) use a mathematical keypair:

Public Key (Share freely)

Anyone can use your Public Key to encrypt a message for you. It acts like an open padlock attached to your mailbox.

Private Key (Keep secret!)

ONLY you possess the Private Key to decrypt messages locked with your Public Key. Never share this with anyone!

Public Key Infrastructure

How Do We Trust a Public Key?

If Alice publishes a public key, how does Bob know it really belongs to Alice and not an attacker?

Step 1

Certificate Authority (CA)

A trusted third party (e.g. Let's Encrypt, DigiCert) verifies domain ownership.

Step 2

Digital Certificate

CA signs a digital certificate linking domain name example.com to its Public Key.

Step 3

Browser Verification

Your web browser uses built-in CA root certificates to cryptographically verify the signature.

HTTPS Security

The TLS 1.3 Handshake

When you connect to https://bank.com, your browser executes a secure key negotiation:

1. Client Hello

Supported ciphers sent.

2. Server Hello

Certificate & server public key returned.

3. ECDHE Key Exchange

Diffie-Hellman generates temporary session key.

4. Encrypted Tunnel

All subsequent traffic uses fast symmetric AES-GCM.

Integrity Primitives

One-Way Hash Functions

A cryptographic hash takes data of any size and produces a fixed-size fingerprint (e.g. SHA-256 = 64 hex characters).

Properties of Secure Hashes (e.g. SHA-256)

Deterministic: Same input ALWAYS produces identical hash output.
One-Way (Irreversible): Computationally impossible to calculate original text from hash.
Avalanche Effect: Changing 1 single bit in input drastically changes 50%+ of hash output.
Collision Resistant: Impossible to find two different inputs that produce the exact same hash.

Python Code

Hashing Data in Python

import hashlib

# Demonstrating the Avalanche Effect
data1 = "Hello World".encode('utf-8')
data2 = "Hello world".encode('utf-8')  # lowercase 'w'

hash1 = hashlib.sha256(data1).hexdigest()
hash2 = hashlib.sha256(data2).hexdigest()

print("Hash 1:", hash1)
# a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e

print("Hash 2:", hash2)
# 64ec88ca00b268e5ba1a35678a1b5316d212f4f366b2477232534a8aeca37f3c
    

Database Protection

Unsalted Passwords & Rainbow Tables

Bad Practice: Raw SHA-256 Hashing

If two users choose password123, their stored hashes are identical. Attackers use precomputed Rainbow Tables to instantly reverse hashes.

Good Practice: Salting & Peppering

A random unique string (Salt) is appended to each password before hashing (e.g. Argon2 or bcrypt). Every stored hash is unique!

Mathematics of Security

Password Entropy Calculation

Entropy measures random unpredictability in bits:

Entropy Formula: E = L * log2(R)

Where:
  L = Length of password/passphrase
  R = Size of character pool (e.g., lowercase=26, mixed=62, full ASCII=95, dictionary words=7,776)

Example 1: "P@ss1234" (L=8, R=95) -> 8 * 6.57 = 52.5 bits (Cracked in seconds)
Example 2: "correct horse battery staple" (L=4 words from 7776 EFF list) -> 4 * 12.9 = 51.6 bits
Example 3: "correct horse battery staple 99!" -> 4 words + 2 chars = 78.4 bits (Takes billions of years)
    

Modern Attack Vectors

Phishing vs Spear Phishing

Mass Phishing

Generic mass emails ("Your banking account is locked!"). Relies on volume and urgency heuristics to trick untrained users.

Spear Phishing & Whaling

Highly targeted attacks using OSINT (Open Source Intelligence). Attacker impersonates a specific CEO, colleague, or teacher using customized context.

Network Attacks

Man-in-the-Middle (MitM)

An attacker intercepts communication between a client and a server without either party knowing.

How MitM Happens on Rogue Wi-Fi:

Attacker sets up an open Wi-Fi AP named School_Guest_Free. All unencrypted traffic (HTTP) passing through is logged. HTTPS prevents MitM eavesdropping because the attacker lacks the legitimate server's private key!

Web Application Security

SQL Injection (SQLi) Basics

Occurs when untrusted user input is directly concatenated into database queries:

-- Vulnerable backend query logic:
query = "SELECT * FROM users WHERE username = '" + user_input + "'"

-- Attacker inputs as username: admin' OR '1'='1

-- Resulting executed SQL:
SELECT * FROM users WHERE username = 'admin' OR '1'='1'
-- Bypasses authentication completely!
    

Defensive Coding

Preventing SQL Injection

Never concatenate string inputs into SQL. Use parameterized queries (Prepared Statements):

# Secure implementation using parameters
cursor.execute(
    "SELECT * FROM users WHERE username = %s AND password = %s",
    (user_input, password_hash)
)
# Database treats user_input purely as a literal string value!
    

Authentication Primitives

Multi-Factor Authentication (MFA)

MFA requires proof from at least two distinct authentication factors:

1. Knowledge

Something you know (Password, PIN, Security Question).

2. Possession

Something you have (Hardware token, TOTP app like YubiKey/Authenticator).

3. Inherence

Something you are (Biometrics: Fingerprint, Face ID, Retina scan).

Security Trade-offs

Comparing MFA Implementation Methods

SMS / Email OTP (Weakest)

Vulnerable to SIM swapping, SS7 interception, and phishing proxy kits (e.g. Evilginx).

FIDO2 / WebAuthn Hardware Keys (Strongest)

Cryptographically bound to domain origin. Phishing resistant! Attacker site cannot reuse response.

Security Architecture

Principle of Least Privilege (PoLP)

Users and software processes must only be granted the minimum level of access necessary to perform their duty.

Role-Based Access Control (RBAC)

Permissions tied to roles (e.g., Student, Teacher, IT Admin). Students cannot access grading APIs.

Zero Trust Model

"Never trust, always verify." Assume network is already breached; authenticate & authorize every single request.

Smartboard Activity

Spot the Vulnerability

A company stores user credentials as: md5(username + password) without salting. An attacker steals the database dump.

Questions to discuss: 1. Why does prepending the username fail as a proper cryptographic salt?
2. Why is MD5 completely banned in modern software systems?

Interactive Exercise

Analyzing a TLS Certificate

Open Chrome/Firefox DevTools (F12) -> Security tab -> View Certificate:

Identify the Subject Alternative Name (SAN)
Locate the Issuer Signature Algorithm (e.g. sha256WithRSAEncryption)
Check the Validity Period and Public Key Size (2048-bit RSA vs 256-bit ECC)

Scenario Analysis

Spot the Red Flags

From: IT Support <admin@school-portal-security-check.net>
Subject: URGENT: Your account will be deleted in 2 hours!
Body: Dear student, our servers were upgraded. Click here to verify your password immediately or lose all your files.

Identify 3 indicators of compromise (IOCs) in this message.

Guided Practice

Implementing Password Salting in Python

import secrets, hashlib

def hash_password(password: str) -> tuple:
    # Generate 16 bytes of cryptographically secure random salt
    salt = secrets.token_bytes(16)
    # Combine salt + password and hash with SHA-256
    key = hashlib.pbkdf2_hmac('sha256', password.encode(), salt, 100000)
    return salt, key

salt, key = hash_password("MySuperSecretPassphrase123")
print("Salt:", salt.hex())
print("Key:", key.hex())
    

Question 1

Which CIA Triad goal is violated by an unencrypted data leak?

AConfidentiality

BIntegrity

CAvailability

DAuthenticity

Click to reveal answer

Question 2

In asymmetric encryption, which key is used to decrypt a message?

AThe sender's public key

BThe recipient's public key

CThe recipient's private key

DThe Certificate Authority's master key

Click to reveal answer

Question 3

What is the primary function of a salt in password hashing?

ATo encrypt the password with a public key

BTo ensure identical passwords produce different hashes

CTo speed up hash calculation time

DTo allow reversing the hash back to plain text

Click to reveal answer

Question 4

Which defense completely eliminates SQL Injection vulnerabilities?

AEncrypting the database drive with AES

BUsing HTTPS for all web traffic

CUsing parameterized queries (Prepared Statements)

DEnabling 2FA for database administrators

Click to reveal answer

Question 5

Why are WebAuthn hardware keys more secure than SMS codes for 2FA?

ASMS codes use weaker symmetric encryption

BHardware keys are domain-bound and immune to phishing

CSMS requires internet connection while WebAuthn does not

DSMS passcodes expire in 30 seconds

Click to reveal answer

Question 6

True or False: Modern HTTPS uses asymmetric encryption for all data transport.

ATrue: Asymmetric keys handle all browser data

BFalse: Asymmetric keys establish session; symmetric AES encrypts data

Click to reveal answer

Common Misconceptions

Busting Security Myths

Myth: "Incognito / Private Browsing makes me completely anonymous online."

Reality: Incognito only deletes local history and cookies when closed. Your ISP, network admin, and visited websites still see your IP address and full network traffic!

Chapter Summary

Key Takeaways

CIA Triad: Confidentiality, Integrity, Availability govern security design.
Encryption: Asymmetric negotiates trust; Symmetric handles high-speed payload transfer.
Hashing: Irreversible fingerprints. Must use salts + slow memory-hard algorithms (Argon2, bcrypt) for passwords.
Zero Trust: Never trust inputs, use parameterized queries, and enforce MFA.

Exit Ticket

Before You Leave

Written Prompt: Explain in 2 sentences why a 5-word random passphrase like correct horse battery staple is mathematically superior to P@ssw0rd1! against brute-force attacks.