Digital Literacy · Grade 8 · Chapter 1

Cybersecurity Basics & Attack Vectors

Understanding how accounts are compromised, how hashes protect passwords, and building multi-layered defenses.

Case Study

Cracked in 0.003 Seconds

In a live demonstration, a computer running a basic password cracker guesses "p@ssword123" instantly. However, adding four random words makes the exact same software take over 4,000 years to test all possibilities.

Class Brainstorm: Why does adding length slow down a computer far more than adding special symbols?

Lesson Objectives

What We Will Master Today

Analyze how automated brute-force attacks calculate password combinations.
Understand cryptographic hashing functions (MD5, SHA-256) and salt protection.
Identify major digital attack vectors: Social Engineering, Phishing, Malware, and MitM.
Design multi-factor authentication (MFA) workflows to secure user accounts.

Prior Knowledge Connection

Your Digital Footprint & Identity

In Grade 7, we explored basic internet safety and digital footprints. In Grade 8, we step into the shoes of cybersecurity engineers to examine the technical mechanics of attacks and defenses.

Grade 7 Focus

Creating strong passwords and avoiding public oversharing on social media.

Grade 8 Focus

Cryptographic hashing algorithms, attack vector analysis, and defense-in-depth architecture.

Core Concept 1

Password Entropy & Brute Force Math

Computers don't guess passwords like humans; they iterate through character sets at billions of guesses per second.

Character Pool (N)

Lowercase (26), Uppercase (26), Numbers (10), Symbols (32). Total pool = 94 possible characters.

Combinations Formula

Total possibilities = N^L where L is length. Exponential growth means length creates exponentially higher security.

Side-by-Side Comparison

Short Complex vs. Long Passphrase

Weak: Short & Complex

P@ss1 (6 chars)

Combinations: ~94⁶ = 689 Billion

Cracking Time: Less than 1 second

Strong: Long Passphrase

blue-galaxy-coffee-rocket (25 chars)

Combinations: Over 10⁴⁵

Cracking Time: Trillions of years

Core Concept 2

Password Hashing: Storing Secrets Safely

Secure websites never store your plaintext password in their database. Instead, they store a one-way cryptographic hash.

One-Way Function: Easily converts plaintext → hash, but mathematically impossible to reverse hash → plaintext.
Deterministic: The exact same input string always produces the exact same hash output.
Avalanche Effect: Changing just one letter completely changes the entire hash string output.

System Architecture

The Hashing & Salting Workflow

STEP 1

User Input
User enters plaintext password "SecretPass".

STEP 2

Salt Addition
Server appends random unique bytes ("Salt").

STEP 3

SHA-256 Hash
Passes salted string into cryptographic function.

STEP 4

Database Save
Stores hash & salt pair; raw password is discarded.

Core Concept 3

Multi-Factor Authentication (MFA)

MFA requires users to present two or more independent credentials before gaining access to an account.

Something You Know

Passwords, PINs, or security question answers.

Something You Have

Authenticator app code, hardware key, or SMS token.

Something You Are

Fingerprint, face scan, or iris biometric verification.

Smartboard Voting & Discussion

Evaluating MFA Reliability

Rank the following 2FA methods from LEAST secure to MOST secure. Why is SMS-based verification vulnerable to SIM-swapping attacks?

Think-Pair-Share: Compare SMS codes vs. Authenticator Apps (TOTP) vs. Hardware Security Keys (YubiKey).

Attack Vector 1

Social Engineering & Phishing

Attackers often target human psychology rather than technical flaws. Phishing tricks users into handing over sensitive credentials voluntarily.

Urgent Pressure: "Account suspended in 24 hours! Click immediately!"
Spoofed Sender Domains: Using fake domains like support@paypa1-security.com.
Spear Phishing: Highly personalized emails tailored using public social media data.

Scenario Analysis

Spotting Phishing Email Indicators

INCOMING EMAIL ALERT

From: IT-Support <admin@school-portal-update.net>
Subject: URGENT: Reset your student password now
Body: Dear student, your school account was flagged for suspicious activity. Click here [http://login.school-portal-update.net/auth] to confirm your password or lose access.

Question: Identify at least 3 suspicious indicators in this message that reveal it is a phishing attack.

Attack Vector 2

Malware: Ransomware & Keyloggers

Malicious software installed on a device can silently capture user inputs or hold data hostage.

Keyloggers

Software or hardware devices that quietly record every keystroke pressed, capturing passwords as they are typed.

Ransomware

Encrypts all files on a computer system and demands payment in cryptocurrency to provide the decryption key.

Attack Vector 3

Man-in-the-Middle (MitM) & Public Wi-Fi

Unencrypted public Wi-Fi networks allow attackers on the same network to intercept unencrypted data packets transmitted by your device.

Eavesdropping: Intercepting HTTP network traffic in plain text.
Rogue Access Points: Fake Wi-Fi hotspots ("Free Coffee Shop Wi-Fi") set up by hackers.
HTTPS Encryption: Encrypts data payload using TLS/SSL to prevent eavesdropping even on untrusted networks.

Network Security Visual

Unencrypted HTTP vs. Secure HTTPS

HTTP (Unencrypted)

Browser → [Plain Text: pass="1234"] → Router → Server

Anyone eavesdropping on the router reads the password directly.

HTTPS (TLS Encrypted)

Browser → [Ciphertext: e9f2a819b] → Router → Server

Eavesdroppers only see scrambled gibberish payload.

Spot the Mistake

Vulnerable Network Configuration

A small business sets up the following network policy. Find 3 major security vulnerabilities:

All employee passwords must be updated every Monday to "Company2024!".
Customer database passwords are saved in a shared Google Sheet titled "Passwords_DoNotDelete".
Wi-Fi network uses WPA2, but 2FA is turned off on all corporate accounts to speed up logins.

Guided Practice

Passphrase Generator Logic

Analyze the following Python logic for generating secure random passphrases:

import random

words = ["solar", "falcon", "quantum", "bridge", "velvet", "orbit"]

def generate_passphrase(num_words=4):
    chosen = random.choices(words, k=num_words)
    return "-".join(chosen)

print(generate_passphrase(4)) # e.g., "falcon-orbit-quantum-solar"
    

Interactive Application

Conducting a Security Audit

Audit Task: Review your school lab computer policies. Check password storage rules, browser auto-fill settings, USB access control, and network firewall defaults.

Action Item: Write down 2 concrete security recommendations for your school principal.

Check Your Understanding

Why are salted cryptographic hashes used for storing passwords?

ATo make passwords shorter so they take up less database space

BTo allow admins to read forgotten user passwords easily

CTo prevent reverse lookup attacks and rainbow table cracking

DTo automatically send SMS verification codes to users

Click to reveal answer

Check Your Understanding

Which pair represents authentic Multi-Factor Authentication (MFA)?

AEntering a password and then entering a security question answer

BEntering a password and scanning a fingerprint on an authenticator app

CEntering a password and re-entering the password to confirm

DUsing two different passwords for two different email accounts

Click to reveal answer

Check Your Understanding

What primary protection does HTTPS provide on public Wi-Fi?

AIt blocks all incoming malware files automatically

BIt increases internet download speed by compressing images

CIt encrypts data sent between your browser and the website

DIt deletes your browsing history when you disconnect

Click to reveal answer

Ethical Discussion

White Hat vs. Black Hat Hacking

Ethical hackers (White Hats) discover system bugs to fix them. Cybercriminals (Black Hats) exploit bugs for profit. Where do "Gray Hats" fit in, and why is authorization crucial?

Legal Note: Port scanning or testing exploits on systems without explicit written permission is illegal regardless of your intent.

Personal Defense Checklist

5-Step Personal Cyber Hygiene Audit

Step 1: Audit all passwords — replace repeated or short passwords with passphrases.
Step 2: Turn on 2FA (Authenticator App) across email and gaming accounts.
Step 3: Check URL bars for https:// and lock icons when logging in.
Step 4: Keep operating systems and software updated with security patches.
Step 5: Never click links in unexpected text messages or emails.

Summary

Defense-in-Depth Model

Security is not a single wall; it is a multi-layered system designed to withstand attacks at every level.

User Layer

Awareness of phishing, passphrases, and strong cyber habits.

Auth Layer

Salted SHA-256 hashing and Multi-Factor Authentication.

Network Layer

TLS/HTTPS encryption, firewalls, and VPN connections.

Exit Ticket

Quick Reflection

On a index card or digitally, answer these two prompts before leaving:

1. What is the mathematical reason why long passphrases beat short complex passwords?
2. Explain how a salt prevents attackers from using precomputed rainbow tables.

Looking Ahead

Next Chapter: What is AI? Systems View

Now that we understand how digital systems protect data, we will explore how AI systems process data, train models, and execute real-time inference!