Cybersecurity and Cryptography

Introduction

Cybersecurity is the practice of protecting digital systems, networks, devices, services, and data from unauthorized access, disruption, manipulation, or destruction. Cryptography is the science of transforming and authenticating information so that people and systems can communicate securely even when an attacker may observe or alter the communication channel. The two fields overlap, but they are not identical: cryptography supplies powerful technical tools, while cybersecurity also includes people, processes, system design, monitoring, recovery, governance, and risk management.

This course is designed for learners in Grades 11–13. You will connect mathematical ideas with practical digital security, learn to reason about risks, and evaluate defensive choices. You will also distinguish legitimate security testing from unauthorized activity. All practical work in this course should use your own devices, teacher-provided examples, or isolated training environments. Never probe, intercept, access, or test a system without clear permission.

Datei:Cartoon Locked Home Network.svg

Learning Goals

By the end of the course, you should be able to explain core cybersecurity goals, distinguish threats from vulnerabilities, compare major cryptographic techniques, reason about authentication and key management, interpret simplified security protocols, evaluate common defensive controls, and discuss how quantum computing affects the future of public-key cryptography.

Cybersecurity Foundations

Security Goals and the CIA Triad

A useful starting point is the CIA triad: Confidentiality, Integrity, and Availability. Confidentiality means that information is available only to authorized people or systems. Integrity means that information and systems remain accurate and are not changed without authorization. Availability means that authorized users can access systems and data when they need them.

Security goals often extend beyond the CIA triad. Authenticity helps you decide whether data or an identity is genuine. Accountability supports tracing actions to responsible actors. Privacy concerns appropriate collection, use, sharing, and protection of personal information. A well-designed system may need to balance all of these goals.

Risk, Threats, Vulnerabilities, and Controls

A threat is something that could cause harm. A vulnerability is a weakness that could be exploited. A risk combines the possibility of a harmful event with its potential impact. A control or safeguard reduces likelihood, impact, or both.

For example, a stolen password is a threat scenario. Reusing the same password across many services is a vulnerability. Multifactor authentication, strong unique passwords, and careful account recovery procedures are controls that reduce the risk of account takeover.

Cybersecurity is therefore not a search for perfect safety. It is the structured management of risk under real constraints such as cost, usability, time, and legal requirements.

A Risk-Management Cycle

The NIST Cybersecurity Framework 2.0 organizes high-level cybersecurity outcomes around six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Governance establishes priorities and responsibilities. Identification builds understanding of assets and risks. Protection applies safeguards. Detection finds suspicious events. Response limits harm during an incident. Recovery restores capabilities and learns from what happened.

These functions are not a single sequence that happens only once. Mature security programs revisit them continuously as technology, organizations, and threats change.

Common Threats and Defensive Thinking

Social Engineering and Phishing

Social engineering attacks target human decision-making rather than only technical weaknesses. Phishing messages may create urgency, imitate trusted people, or offer something attractive in order to make a recipient reveal information, approve a login, open a harmful attachment, or visit a deceptive website.

A strong defensive habit is to verify unexpected requests using a trusted channel. You should also report suspicious messages according to your school or organization policy rather than interacting with them.

Malware, Ransomware, and Exploited Vulnerabilities

Malware is software designed to cause harm or perform unwanted actions. Ransomware can deny access to data or systems and demand payment. Attackers may also exploit software vulnerabilities that have not yet been patched.

Defensive measures include timely updates, secure configuration, least privilege, endpoint protection, network segmentation, tested backups, and monitoring. No single control is enough. Defense in depth uses multiple independent safeguards so that one failure does not automatically cause total compromise.

Authentication and Access Control

Authentication asks, “Who are you?” Authorization asks, “What are you allowed to do?” The Principle of least privilege gives users and services only the access they actually need.

Multi-factor authentication combines independent factors such as something you know, something you have, or something you are. Stronger authentication is especially important for email, administrative accounts, cloud services, and password managers because compromise of one of these can affect many other systems.

Four High-Value Personal Security Habits

For everyday digital life, four practical habits have especially broad value: recognize and report phishing, use long and unique passwords with a password manager, enable multifactor authentication, and install software updates promptly. These practices do not eliminate all risk, but they block many common attack paths.

Cryptography: Core Concepts

Plaintext, Ciphertext, Algorithms, and Keys

In encryption, readable data is called plaintext. An encryption algorithm transforms plaintext into ciphertext using a key. Decryption uses the appropriate key to recover the plaintext.

Modern cryptographic design assumes that an attacker may know the algorithm. Security should depend on protected keys, not on hiding how the algorithm works. This idea is closely related to Kerckhoffs's principle.

Symmetric Cryptography

In symmetric cryptography, the same secret key, or closely related secret information, is used for encryption and decryption. Symmetric encryption is efficient for protecting large amounts of data, but the communicating parties must first obtain the secret key securely.

AES is a widely used symmetric block cipher standardized by NIST. AES operates on 128-bit blocks and supports key lengths of 128, 192, or 256 bits. Real systems must also choose a secure mode of operation and manage keys, nonces, and authentication correctly. You should not invent your own cryptographic construction for real security.

Datei:Symmetric key encryption.svg

Public-Key Cryptography

In Public-key cryptography, each participant has a key pair. A public key can be shared widely, while the corresponding private key must remain secret. Depending on the system, public-key cryptography can support encryption, digital signatures, or shared-secret establishment.

Public-key techniques solve important key-distribution problems, but they are computationally more expensive than symmetric encryption. Modern protocols therefore often use hybrid cryptography: public-key methods establish or protect a shared secret, then symmetric cryptography protects the main data stream.

Key Exchange and Shared Secrets

A key-exchange protocol lets two parties establish shared secret material even when they communicate over an open network. Diffie–Hellman key exchange is a classic example. Its mathematical idea is powerful, but unauthenticated key exchange alone does not prove who is on the other end. Real protocols combine key exchange with authentication to resist man-in-the-middle attacks.

Fehler beim Erstellen des Vorschaubildes:

Datei:Public key shared secret.svg

Hash Functions, Passwords, and Message Authentication

Cryptographic Hash Functions

A cryptographic hash function maps an input of arbitrary length to a fixed-length digest. Useful cryptographic hashes are designed so that it is computationally difficult to reverse the digest to find the original input, to find another input with the same digest, or to create two different inputs with the same digest.

A small change in input should usually cause a large, unpredictable change in the digest. Hash functions are used in integrity checks, digital signatures, data structures, and many authentication systems. Hashing is not encryption because a hash is not designed to be decrypted.

Datei:Cryptographic Hash Function.svg

The Commons diagram above uses SHA-1 to illustrate hash behavior. Treat it as a conceptual illustration rather than a recommendation for new security systems.

Password Storage

A secure service should not store user passwords in readable form. It should use a password-hashing function designed to make guessing expensive. Modern guidance commonly recommends memory-hard or deliberately slow password-hashing schemes such as Argon2, with a unique random salt for each password.

A salt is not a secret. Its purpose is to prevent identical passwords from producing identical stored values and to defeat precomputed lookup tables. Fast general-purpose hashes such as SHA-256 are useful for many integrity tasks but are not suitable by themselves for modern password storage because attackers can test guesses too quickly.

Message Authentication Codes

A Message authentication code uses a secret key to produce a tag that helps verify both message integrity and authenticity. An HMAC is a widely used construction based on a cryptographic hash function. Unlike a plain hash, a MAC depends on secret key material shared by authorized parties.

Digital Signatures, Certificates, and Secure Web Connections

Digital Signatures

A Digital signature allows a verifier to check whether data was signed by the holder of a corresponding private key and whether the signed data has changed. Digital signatures can support authenticity, integrity, and non-repudiation in appropriate legal and technical contexts. They do not automatically provide confidentiality.

Datei:Public key signing.svg

Certificates and Public-Key Infrastructure

A digital certificate binds a public key to information about an identity or service. In a public-key infrastructure, certificate authorities and validation rules help systems decide which public keys to trust.

Trust is not magic. A browser or operating system starts with trusted roots, checks certificate chains and names, and applies protocol rules. Users still need to watch for deceptive domains, compromised accounts, and unsafe devices.

TLS and HTTPS

TLS protects many internet connections, including HTTPS. A modern TLS connection uses cryptographic negotiation, authenticated key establishment, and symmetric encryption to create a protected channel. The precise details vary by protocol version and configuration, so simplified diagrams are models rather than complete packet-by-packet specifications.

Fehler beim Erstellen des Vorschaubildes:

From Classical Ciphers to Modern Cryptography

Caesar Ciphers and Substitution

A Caesar cipher shifts letters by a fixed amount. It is useful for learning because you can encrypt and decrypt by hand, but it offers essentially no security against modern analysis. Simple substitution ciphers also leak patterns from the original language, making techniques such as frequency analysis effective.

The lesson is important: an algorithm can look confusing without being secure. Modern cryptography depends on well-studied mathematical constructions, careful implementation, and strong keys rather than secrecy of the method.

Datei:Confederate cipher disk.jpg

The Enigma Machine as a Historical Case

The Enigma machine used rotors and changing substitutions to create a much more complex cipher than a simple letter shift. Its history shows that cryptographic security depends on the whole system: machine design, key procedures, operator behavior, intelligence, mathematics, and implementation all matter.

Datei:EnigmaMachineLabeled.jpg

The Mathematics Behind Cryptography

Modular Arithmetic

Many cryptographic systems use Modular arithmetic, where numbers “wrap around” after a modulus. Clock arithmetic is a familiar example. Public-key systems often rely on mathematical problems that are easy to compute in one direction but believed to be difficult to reverse without special information.

You do not need to treat mathematics as a black box. Work through small toy examples by hand to understand the structure, but remember that tiny educational parameters are never secure for real communication.

Entropy and Randomness

Cryptographic keys need unpredictable randomness. If a key is generated from a weak or predictable source, even a strong algorithm can fail. Cryptographically secure random number generators are therefore a critical part of key generation, nonces, salts, and many protocols.

Entropy is a way to reason about uncertainty. In practice, security depends not only on theoretical key size but also on whether keys were generated, stored, rotated, and destroyed safely.

Post-Quantum Cryptography and Crypto Agility

Quantum computers do not make every cryptographic method useless. Large fault-tolerant quantum computers would particularly threaten widely used public-key systems based on integer factorization and discrete logarithms. Symmetric cryptography and hash functions are affected differently and can often compensate with appropriate parameter choices.

In 2024, NIST finalized its first three post-quantum cryptography standards: FIPS 203 for ML-KEM key establishment, FIPS 204 for ML-DSA digital signatures, and FIPS 205 for SLH-DSA digital signatures. These standards are designed to resist attacks from both classical and future quantum computers.

Crypto agility means designing systems so that cryptographic algorithms and keys can be replaced when standards, threats, or requirements change. Migration matters because data stolen today could potentially be stored and attacked later.

Security Engineering and Responsible Practice

Security Is a System Property

Strong encryption cannot repair every security failure. If malware controls an endpoint, if an administrator grants excessive permissions, if backups are missing, or if a user is deceived into approving a fraudulent request, cryptography alone may not prevent harm.

Security engineering therefore combines secure architecture, reliable software, access control, monitoring, incident response, backups, user education, and governance. The best solution is often the one that reduces several risks at once without creating unreasonable complexity.

Ethical and Legal Boundaries

Cybersecurity skills carry responsibility. Only test systems you own or have explicit authorization to test. Follow your school rules, organizational policies, contracts, and applicable law. Use simulations, capture-the-flag exercises, and intentionally vulnerable training systems when you want hands-on practice.

Responsible disclosure means reporting a discovered weakness through an appropriate channel instead of exploiting it or publishing sensitive details that could expose users to harm.

Reliable Reference Points

For current technical guidance, compare educational material with primary and well-established sources. Useful starting points include the NIST Cybersecurity Framework, NIST Post-Quantum Cryptography project, CISA Secure Our World resources, and the OWASP Cheat Sheet Series.

Interactive Tasks

Quiz: Test Your Knowledge

Which security goal focuses on preventing unauthorized changes to data? (Integrity) (!Availability) (!Confidentiality) (!Redundancy)

What is the main difference between a threat and a vulnerability? (A threat can cause harm while a vulnerability is a weakness) (!A threat is always software while a vulnerability is always human) (!A vulnerability is always deliberate while a threat is accidental) (!A threat is a password while a vulnerability is a firewall)

Which statement best describes symmetric encryption? (The communicating parties use a shared secret key) (!Anyone can decrypt with a public key) (!It produces a password hash instead of ciphertext) (!It never requires key management)

What is a major purpose of public-key cryptography? (It can support secure key establishment and digital signatures) (!It removes the need to protect private keys) (!It guarantees that all software is free of vulnerabilities) (!It makes passwords unnecessary in every system)

Why is a unique salt added when storing password hashes? (It prevents identical passwords from producing identical stored values) (!It makes the password readable to administrators) (!It replaces the need for a password hashing function) (!It allows the hash to be decrypted later)

Which property is expected from a cryptographic hash function? (A small input change should usually produce a very different digest) (!The digest must reveal the original message) (!All inputs must produce different digest lengths) (!The same input should produce a random new digest each time)

What does a digital signature primarily help a verifier check? (Authenticity and integrity of signed data) (!Confidentiality of every stored file) (!Physical location of the signer) (!Availability of a network connection)

Why is multifactor authentication useful? (It requires more than one independent type of evidence) (!It guarantees that phishing is impossible) (!It stores passwords in plaintext for recovery) (!It removes the need to update software)

Which set names the six functions in NIST Cybersecurity Framework 2.0? (Govern Identify Protect Detect Respond Recover) (!Encrypt Hash Sign Patch Monitor Backup) (!Plan Buy Install Test Launch Archive) (!Classify Compress Transfer Delete Restore Audit)

Which statement about post-quantum cryptography is correct? (It develops cryptographic standards designed to resist future quantum attacks) (!It requires a quantum computer for every secure connection) (!It makes symmetric encryption impossible to use) (!It means all current data is already readable by quantum computers)

Memory Game

Confidentiality	Restricting information to authorized access
Vulnerability	A weakness that could be exploited
Ciphertext	Data transformed into an unreadable encrypted form
Salt	A unique random value added during password hashing
Certificate	A signed data structure that binds a public key to identity information
Nonce	A value intended to be used only once in a cryptographic context

Drag and Drop

Match the correct terms.	Topic
Shared secret encryption	Symmetric cryptography
Public and private key pair	Asymmetric cryptography
Fixed length digest	Cryptographic hashing
Proof made with a private key	Digital signature
Extra login factor	Multifactor authentication

...

Crossword Puzzle

Confidentiality	Which security goal limits information to authorized users?
Integrity	Which security goal protects data from unauthorized change?
Availability	Which security goal keeps services accessible when needed?
Encryption	What process transforms plaintext into ciphertext using a key?
Phishing	What social engineering attack often uses deceptive messages?
Signature	What one-word term completes the phrase digital what?

LearningApps

Cloze Text

The CIA triad includes confidentiality, integrity, and

. A weakness that an attacker could exploit is called a

. Symmetric encryption protects data with a shared secret

. Public-key cryptography uses a public key together with a corresponding

key. A cryptographic hash function produces a fixed-length

. Password databases should use a unique random

for each stored password hash. A digital signature helps a verifier check authenticity and

. TLS commonly protects web traffic carried by

. NIST finalized its first three post-quantum cryptography standards in

. Designing systems so cryptographic methods can be replaced supports crypto

.

Open-Ended Tasks

Easy

CIA Triad Poster: Create a one-page visual that explains confidentiality, integrity, and availability with one original everyday example for each goal.
Phishing Message Analysis: Compare two teacher-provided sample messages and mark the clues that would make you verify one of them before acting.
Caesar Cipher Activity: Encrypt a short classroom-safe sentence with a Caesar shift, exchange it with a partner, and explain why the method is insecure.
Personal Security Checklist: Design a checklist for safer student accounts that covers unique passwords, password managers, multifactor authentication, updates, and recovery options.

Standard

Threat Model for a School Service: Choose a fictional school platform, identify assets, likely threats, vulnerabilities, and defensive controls, then present your reasoning in a table.
Hash Function Investigation: Use an offline classroom tool to hash several harmless text strings, change one character at a time, and document how the digest changes.
Cryptography Explainer Video: Produce a two-minute video that compares symmetric encryption, public-key cryptography, hashing, and digital signatures without using real secret keys.
Cybersecurity Career Interview: Interview a cybersecurity, IT, software, legal, or data-protection professional and summarize how technical security and organizational processes interact.

Advanced

TLS Trust Map: Draw a conceptual diagram showing a browser, server, certificate, certificate authority, key exchange, and encrypted session, then annotate where trust assumptions enter.
Password Storage Design Review: Evaluate a fictional application that stores passwords with a fast unsalted hash and propose a safer design using a modern password-hashing function and unique salts.
Post-Quantum Migration Brief: Write a policy brief explaining why an organization might inventory cryptographic dependencies and plan for post-quantum migration before a large quantum computer exists.
Incident Response Simulation: In a teacher-controlled tabletop exercise, respond to a fictional ransomware incident by assigning actions for detection, containment, communication, recovery, and lessons learned.

Learning Assessment

Risk-Based Security Decision: Given a fictional school network with limited budget, choose three security controls, rank them by expected risk reduction, and justify the trade-offs.
Cryptographic Tool Selection: For four scenarios involving stored files, password verification, signed software, and a secure connection, select appropriate cryptographic techniques and explain why alternatives are less suitable.
Protocol Reasoning: Explain why unauthenticated key exchange can be vulnerable to an intermediary and how authentication changes the trust model without giving attack instructions.
Defense in Depth Evaluation: Analyze how updates, least privilege, backups, monitoring, and multifactor authentication work together when any single control can fail.
Quantum Readiness Argument: Compare the risks to public-key and symmetric cryptography from future quantum computing and recommend a sensible migration priority.
Ethics and Authorization Case: Evaluate a scenario in which a student discovers a possible weakness in a school service and propose a responsible, lawful response path.

Evidence of Learning

Knowledge: You can accurately explain the CIA triad, risk concepts, common threat categories, symmetric and asymmetric cryptography, hashes, password storage, digital signatures, certificates, TLS, and post-quantum cryptography.

Reasoning: You can connect a security goal to a threat model, compare alternative controls, identify assumptions, and explain why a technically strong component can still fail inside a weak system.

Practical Skills: You can analyze benign examples, construct clear diagrams, perform classroom-safe cryptographic demonstrations, document findings, and communicate defensive recommendations.

Products: Evidence may include a security poster, threat model, hash investigation, explainer video, interview summary, TLS trust map, design review, policy brief, or tabletop incident-response report.

Transfer: You can apply the same principles to unfamiliar systems such as cloud storage, school platforms, mobile devices, online banking, software updates, and future cryptographic migrations.