Learn how cryptography protects data at rest and in transit, how identity systems verify who you are, and how authorization controls decide what you can do.
Implement authorization models: RBAC vs ABAC vs DAC vs MAC
Design password policies that balance security and usability
Distinguish encryption at rest vs. in transit and apply correctly
Module 1: Symmetric vs Asymmetric Encryption
The two fundamental approaches to scrambling data so only intended recipients can read it.
Fast & Efficient
Symmetric Encryption
Uses a single shared secret key for both encryption and decryption. Fast, efficient, ideal for bulk data encryption. The same key must be securely exchanged between parties before communication begins.
Common Algorithms
AES (Advanced Encryption Standard) — 128/192/256-bit keys, current gold standard
ChaCha20 — fast software implementation, used in TLS 1.3
The Key Distribution Problem: How do you safely share the secret key with the recipient? This is the fundamental challenge symmetric encryption solves imperfectly — leading to asymmetric encryption.
Secure Key Exchange
Asymmetric Encryption
Uses a key pair: a public key (shared openly) and a private key (kept secret). Data encrypted with the public key can only be decrypted with the matching private key, and vice versa.
Performance Trade-off: Asymmetric encryption is 1000x slower than symmetric. That's why most protocols (like TLS) use asymmetric crypto just to exchange a symmetric session key, then switch to symmetric for the actual data transfer.
How They Work Together (Hybrid Approach)
Example: Sending an encrypted email
=====================================
Alice wants to send a secret message to Bob.
Step 1 (Asymmetric): Alice encrypts a RANDOM session key
with Bob's PUBLIC KEY.
[Session Key] --encrypted with--> [Bob's Public Key] --> [Encrypted Key Package]
Step 2 (Symmetric): Alice encrypts the ACTUAL MESSAGE
with the SESSION KEY (fast!).
[Message] --encrypted with--> [Session Key] --> [Encrypted Message]
Step 3: Alice sends BOTH pieces to Bob.
Bob receives:
- Encrypted Key Package -> decrypts with HIS PRIVATE KEY -> gets Session Key
- Encrypted Message -> decrypts with Session Key -> gets original Message
Result: Secure, fast communication without pre-sharing secrets!
Module 2: Hash Functions
One-way mathematical functions that verify data integrity — not encryption, but equally critical.
What Hash Functions Do
A hash function takes any input data and produces a fixed-length string of characters (the "hash" or "digest") that uniquely represents that data. The process is one-way — you cannot reverse a hash to recover the original data.
Key Properties
Deterministic: Same input always produces the same hash
Fast to compute: Given input, hash is quick to calculate
Pre-image resistant: Given a hash, cannot find the original input
Collision resistant: Extremely unlikely that two different inputs produce the same hash
Avalanche effect: A tiny change in input produces a drastically different hash
Systems never store plain-text passwords. They hash each password with a salt (random data) using bcrypt, scrypt, or Argon2. On login, the entered password is hashed the same way and compared to the stored hash.
File Integrity Verification
Download a file? Check its SHA-256 hash against the publisher's published hash. If they match, the file is authentic and untampered. Critical for OS installs, security tools, and firmware updates.
Digital Signatures
A sender hashes a document, then encrypts the hash with their PRIVATE key. Anyone can verify by decrypting with the sender's PUBLIC key and comparing hashes. Proves authenticity AND integrity.
Module 3: Digital Certificates & PKI
The trust infrastructure that makes secure online communication possible — from HTTPS websites to code signing.
What Is a Digital Certificate?
A digital certificate is an electronic "passport" that binds a public key to an identity (person, server, organization). It's issued by a trusted Certificate Authority (CA) and contains:
Name and digital signature of the issuing Certificate Authority
Validity period (not before / not after dates)
Certificate serial number and revocation information (CRL/OCSP)
Format: X.509 is the standard format (used for TLS/SSL certificates, S/MIME, code signing).
PKI (Public Key Infrastructure) Explained
PKI Trust Hierarchy
===================
[Root CA]
(Self-Signed, Trusted Store)
| \
___________| \___________
| |
[Intermediate CA] [Intermediate CA]
(Subordinate) (Subordinate)
| |
_______|______ _______|______
| | | |
[Server Cert] [Client Cert] [Code Sig] [Email Cert]
example.com user@corp Notepad.exe bob@mail.com
Flow:
1. Browser visits https://example.com
2. Server presents its certificate (issued by Intermediate CA)
3. Browser checks: Is this Intermediate CA signed by a Root CA
I trust? (Yes -> certificate is valid)
4. Browser verifies certificate matches the domain name
5. Browser verifies certificate hasn't expired or been revoked
6. Secure TLS connection established
Trust Chain Matters: A certificate is only as trustworthy as the chain of CAs that vouch for it. Browsers maintain a "trusted root store" — certificates from CAs not in this store trigger warnings. Never ignore SSL certificate warnings.
Module 4: SSL/TLS Explained
The protocol that secures every HTTPS connection you make — behind the little padlock icon.
How TLS Handshake Works
TLS 1.3 Handshake (Simplified)
==============================
Client Server
| |
|--- ClientHello (cipher suites) -->|
| |
|<- -- ServerHello + Certificate -|
| + ServerKeyExchange |
| |
|--- ClientKeyExchange ---------->|
| + ChangeCipherSpec |
| + Finished |
| |
|<- -- ChangeCipherSpec ---------|
| + Finished |
| |
== Secure channel established ==
== All data encrypted from here ==
TLS 1.3 eliminates round trips vs TLS 1.2 (1-RTT vs 2-RTT)
Uses ephemeral keys (ECDHE) for Perfect Forward Secrecy
Key Concepts
Concept
Explanation
Why It Matters
Perfect Forward Secrecy (PFS)
Each session uses a unique ephemeral key. Compromising the server's long-term private key does NOT compromise past session keys.
Protects historical communications even if the server is later compromised.
Cipher Suites
Named combinations of key exchange + encryption + MAC algorithms (e.g., TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256).
HTTP Strict Transport Security — forces browsers to only use HTTPS for a domain.
Prevents SSL stripping attacks where attackers downgrade HTTPS to HTTP.
Certificate Pinning
Hard-coding expected certificates in client applications.
Prevents man-in-the-middle with fraudulent CA-issued certificates (rarely used due to key rotation problems).
Module 5: Authentication Methods
Proving who you are — the layers that stand between attackers and your accounts.
The Three Factors of Authentication
Something You Know
Knowledge Factor
Passwords and PINs
Security questions ("mother's maiden name")
Passphrases
Most common but also most easily compromised through guessing, phishing, or database breaches.
Something You Have
Possession Factor
Smart cards and proximity cards
Hardware tokens (YubiKey, RSA SecurID)
Mobile phone (SMS codes, TOTP apps)
Security keys (FIDO2/WebAuthn)
Much harder to compromise remotely. Physical possession is required.
Something You Are
Inherence Factor
Fingerprint / biometric scanners
Face recognition (Face ID)
Iris/retina scanning
Voice recognition
Unique to each individual but raises privacy concerns. Generally the strongest factor.
Multi-Factor Authentication (MFA)
MFA requires two or more of the above factors to be satisfied simultaneously. This is the single most effective control against account compromise — blocking over 99% of automated attacks (Microsoft 2023).
MFA Methods Ranked (Most to Least Secure)
Rank
Method
Security Level
Notes
1
FIDO2 / WebAuthn security keys
Highest
Phish-resistant, hardware-bound, recommended by NIST
2
OTP apps (TOTP)
High
Google Authenticator, Authy, 1Password — 6-digit codes
3
Medium
Okta Verify, Microsoft Authenticator push approvals
4
HMAC-based OTP (push + pin)
Medium+
Requires entering a PIN shown on screen into the app
5
SMS voice codes
Weak
SIM swapping, SS7 attacks, interception possible
6
Email codes
Very Weak
Easily intercepted if email is compromised
Module 6: Authorization Models
Once someone is authenticated, how do you control what they can actually do?
Role-Based
RBAC (Role-Based Access Control)
Permissions are assigned to ROLES, and users are assigned to roles. When someone joins as "HR Manager," they automatically inherit all permissions associated with that role.
Pros: Simple to manage at scale, clear audit trail, easy to onboard/offboard
Cons: Role explosion in complex organizations, doesn't handle dynamic contexts well
Used by: Active Directory groups, AWS IAM roles, most enterprise software
Attribute-Based
ABAC (Attribute-Based Access Control)
Fine-grained decisions based on attributes of the user, resource, action, and environment. "Allow access if: user.department == 'Finance' AND time is business hours AND device is company-managed."
Cons: Complex to design and maintain, policy evaluation overhead
Standards: XACML, OAuth 2.0 scopes, Open Policy Agent
Traditional
DAC & MAC
DAC (Discretionary): Resource owners decide who gets access (Windows file permissions, Linux chmod). Flexible but inconsistent.
MAC (Mandatory): Central authority assigns labels (Top Secret, Confidential). Used in military/government. Users cannot change access levels regardless of ownership.
The Least Privilege Principle
Core Security Principle: Every user, program, and process should operate using the minimum set of permissions necessary to accomplish its task. Nothing more. This limits the blast radius of compromised accounts and Insider threats.
Just-In-Time (JIT) Access: Grant elevated permissions only when needed, for a limited time window, with automatic expiration
Just-Enough-Access (JEA): Restrict commands and parameters available during elevated sessions
Regular Access Reviews: Quarterly audits of who has what access — remove stale permissions
Separation of Duties: Critical actions require multiple authorized individuals (no single point of failure)
Module 7: Password Policies & Management
Passwords remain the dominant authentication method. Making them stronger and easier to manage is essential.
NIST SP 800-63B Recommended Practices (2024)
Old Practice (Avoid)
New Best Practice
Reason
Require periodic password changes
Change ONLY when compromise is suspected
Forced rotations lead to predictable patterns (Password1, Password2...)
Open-source, free tier available, self-hostable option, cross-platform. Great for organizations on a budget.
KeePassXC
Offline, local storage, completely free. Maximum privacy but requires manual syncing across devices.
Module 8: Encryption at Rest vs In Transit
Data is vulnerable in two states — both must be protected.
Data at Rest
Encryption While Stored
Protects data on disks, databases, backups, and portable media. If physical theft or unauthorized access occurs, the data remains unreadable without the decryption key.
Implementation Options
Full Disk Encryption (FDE): BitLocker (Windows), FileVault (macOS), LUKS (Linux)
Database Encryption: TDE (Transparent Data Encryption), column-level encryption
Backup Encryption: Encrypt before backing up to cloud/offsite
USB Drive Encryption: VeraCrypt, hardware-encrypted USB drives
Data in Transit
Encryption During Transfer
Protects data as it travels across networks — email, web requests, file transfers, VPN tunnels. Prevents eavesdropping and man-in-the-middle attacks.
Implementation Options
TLS/HTTPS: All web traffic, API calls, internal services
SSH: Remote shell, SCP/SFTP file transfers
IPsec VPN: Site-to-site and remote access VPNs
S/MIME: Email encryption and digital signatures
PGP/GPG: End-to-end email and file encryption
Remember: Encryption is only as strong as your key management. A broken encryption scheme with poor key handling is worse than no encryption at all (false sense of security). Follow KMS best practices: rotate keys regularly, store keys separately from data, monitor key access logs.
Knowledge Check
Q1: Why can't you reverse a SHA-256 hash to get the original data?
Show Answer
Hash functions are one-way mathematical functions by design. They compress arbitrarily large input into a fixed-size output through irreversible operations (bitwise operations, modular arithmetic, compression functions). There are infinitely many possible inputs that map to the same hash output, making reversal mathematically impossible. This property is called pre-image resistance.
Q2: What is the main advantage of AES over RSA for encrypting large files?
Show Answer
Speed. AES (symmetric) is approximately 1000x faster than RSA (asymmetric) for equivalent security levels. That's why hybrid schemes are used: RSA exchanges a temporary AES session key, then AES encrypts the actual data. This combines RSA's secure key exchange with AES's fast bulk encryption.
Q3: What does "Perfect Forward Secrecy" mean in the context of TLS?
Show Answer
PFS means that each TLS session uses a unique, ephemeral key agreement (typically ECDHE). If an attacker later obtains the server's long-term private key, they CANNOT retroactively decrypt previously captured encrypted sessions — because those sessions used different temporary keys that are now destroyed. Without PFS, compromising the server key would expose all historical traffic.
Q4: What's the difference between authentication and authorization?
Show Answer
Authentication (AuthN) answers "Who are you?" — verifying identity through passwords, MFA, biometrics. Authorization (AuthZ) answers "What are you allowed to do?" — determining permissions and access rights after identity is confirmed. MFA is authentication; RBAC/ABAC policies are authorization.
Hands-On Practice Checklist
☐ Complete These Labs
Resources & Further Reading
Standard
NIST SP 800-63B
The authoritative guide on digital identity guidelines — passwords, MFA, and authentication best practices.
Interactive
Visual Crypto Simulator
See encryption algorithms in action with interactive demos showing how data transforms at each step.
Tool
SSL Lab's SSL Test
Grade any website's TLS configuration (A+ to F). Essential for understanding real-world security posture.
Practice
Cryptopals Challenges
Hands-on programming challenges that teach crypto by breaking it. Deep dive into how encryption really works.
Course
Coursera — Crypto I (Stanford)
Dan Boneh's legendary cryptography course. Free to audit. Covers everything from classical ciphers to modern protocols.
Reference
TLS 1.3 Specification (RFC 8446)
The actual protocol spec. Technical but essential for understanding exactly how TLS works under the hood.
➔ Next Step: Now that you understand encryption and access control theory, apply it practically in Endpoint Security & Management — where these concepts become real tools, configurations, and policies on actual machines.
Proceed to Endpoint Security →