Security Architecture Slides Security Architecture
The CIA Triad and Modern Network Threats
[ SYSTEM SECURED ] _
The "What If" Scenario
If a hacker launches a massive DDoS attack and takes down Netflix for 12 hours...
Is it a...
Privacy Breach?
Did they see your password or viewing history?
Or is it...
Something Else?
What exactly did we lose during those 12 hours?
The Foundation: The CIA Triad
The three pillars of information security.
Confidentiality
Ensuring that sensitive information is only accessible to those authorized.
"KEEP IT SECRET"
Integrity
Guaranteeing that data is accurate and hasn't been altered by bad actors.
"KEEP IT TRUE"
Availability
Ensuring that systems are ready for use when authorized users need them.
"KEEP IT READY"
Attacking Confidentiality
Phishing
Tricking users into revealing private credentials via fake emails or sites.
Man-in-the-Middle (MITM)
Eavesdropping on a connection to intercept private data packets.
"The goal of these attacks is to
Attacking Integrity
Data Tampering
Intercepting a message and changing its contents before it arrives.
SQL Injection
Inserting malicious code into a database query to manipulate stored data.
"The goal is to change the letter inside the envelope without anyone noticing."
Attacking Availability
DDoS Attack
Flooding a network with traffic until it crashes or becomes unreachable.
Ransomware
Locking a user out of their own system until a payment is made.
"The goal is to shred the envelope or hide it so it can't be used."
Class Challenge
You are the security lead for a major hospital. A group of hackers deletes all patient medical records.
Which part(s) of the CIA Triad were violated? Why?
Network Threat Worksheet Network Threat Analysis
Case Study & Triad Categorization
Agent Name:
Date:
The Security Mission
Security professionals use the CIA Triad to classify the nature of an attack. Below are several real-world security incidents. For each scenario, identify which pillar(s) of the triad were violated (Confidentiality, Integrity, or Availability) and explain the reasoning behind your classification.
1
The Rogue Gradebook
A student discovers a faculty password and logs into the school system. They change their grade in Advanced Algebra from a 'C' to an 'A' without any other changes to the system.
Confidentiality
Integrity
Availability
Technical Justification:
2
The Digital Roadblock
An e-commerce website is targeted by a botnet that sends 50 million requests per second. Legit customers are unable to access the site to make purchases for several hours during a holiday sale.
Confidentiality
Integrity
Availability
Technical Justification:
3
The Silent Spectator
A bad actor sits in a public coffee shop using a packet sniffer tool. They successfully intercept and read clear-text private messages being sent from a customer's laptop to a server.
Confidentiality
Integrity
Availability
Technical Justification:
System Architect Challenge
Ransomware attacks usually encrypt a user's data so they cannot read it or access it without a key. Does this violate Availability , Confidentiality , or both? Argue your case below using specific definitions.
CIA Triad Teacher Guide Teacher Facilitation Guide
Lesson 1: CIA Triad & Network Threats
Lesson Objectives
Define the three components of the CIA Triad.
Categorize various network attacks by the security pillar they impact.
Explain how a single attack can impact multiple areas of the triad.
Pacing Guide
Hook 10m
Direct Instr. 20m
Case Study 20m
Debrief 10m
Worksheet Answer Key
Scenario 1: Rogue Gradebook
Primary Pillar: Integrity
"The core issue is that the data (the grade) is no longer accurate. While a confidentiality breach occurred (getting the password), the 'A' is an integrity violation."
Scenario 2: Digital Roadblock (DDoS)
Primary Pillar: Availability
"This is a classic Availability attack. The data is safe and true, but it is unreachable for authorized users."
Scenario 3: Silent Spectator (MITM)
Primary Pillar: Confidentiality
"Since the attacker is just reading (sniffing) the packets without changing them or stopping them, only confidentiality is lost."
Discussion Deep-Dives
The Ransomware Debate
Ask: "If data is encrypted, is that a confidentiality breach?"
Insight: Usually No. The hackers often don't see the data themselves, they just make it unreadable for you. It's primarily an Availability and Integrity violation.
The Netflix Hook
Ask: "Why do news reports often say 'Hacked' even when it's just a DDoS?"
Insight: Media uses 'hacked' for any incident. Using the CIA triad helps engineers communicate specific risks to stakeholders.
Cryptography Logic Slides The Math of Secrets
Symmetric vs. Asymmetric Encryption
Status: ENCRYPTED
The Paradox of Trust
How can two people agree on a secret code if they are being watched?
"If I tell you the key over the phone, the listener now has the key too."
The Key Exchange Problem
Symmetric Encryption
The Same Key is used for both locking and unlocking.
Very Fast (Simple Math)
Hard to distribute keys securely
Examples: AES, Caesar Cipher
Plaintext
Ciphertext
KEY: 12345
Asymmetric Encryption
Uses a Key Pair: One to lock, another to unlock.
Public Key
Shared with everyone. Used only to encrypt .
Private Key
Kept top secret. Used only to decrypt .
The Mailbox Analogy : Anyone can drop mail in (Public), only the owner has the key (Private).
Solves the key exchange problem!
Much slower (Complex Math)
Why not use both?
1
Use Asymmetric to securely agree on a secret key.
2
Use Symmetric for the actual fast data transfer.
This is how the entire Internet works.
Encryption Showdown Activity The Encryption Enigma
Cryptographic Simulation Activity
NAME:
1
Phase One: Symmetric Speed
Symmetric encryption uses the same key for encryption and decryption. In this Caesar Cipher, every letter is shifted 3 places forward in the alphabet (A becomes D, B becomes E, etc.).
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
Decrypt this message (Key = 3):
WKH FRGH LV VDIH
Write decrypted message here...
Encrypt this message (Key = 3):
HIDE THE SECRET
Write encrypted message here...
2
Phase Two: The Key Dilemma
Imagine you want to send a symmetric key to a friend. You are both on a public Zoom call with 100 people listening. Is there any way to share the key "3" without anyone else knowing?
3
Phase Three: Asymmetric Logic
Scenario: Public Key Exchange
Alice publishes her Public Key (a unique open padlock) on her website. Bob downloads the padlock, puts his secret message in a box, and snaps the lock shut .
Can Alice's enemy (Eve) open the box if she intercepts it?
Yes
No
Why?
The Cryptographer's Rule
"Asymmetric encryption allows you to secure a line of communication with someone you have never met and with whom you have never shared a secret."
The math behind this is modular arithmetic (Prime Numbers).
Cryptography Quick Reference Cryptography Cheat Sheet
Quick Reference Guide v1.0
Topic: 1.2 Encrypt
S Symmetric
Mechanism
One single key is used to both encrypt and decrypt the data.
Pros & Cons
Fast and efficient.
Key exchange is high-risk.
Real World
AES-256, DES, Caesar Cipher
A Asymmetric
Mechanism
A key pair is used: Public Key (encrypt) and Private Key (decrypt).
Pros & Cons
Solve the Key Exchange problem.
Slow and complex math.
Real World
RSA, Diffie-Hellman, ECC
The Essential Terms
Plaintext
The original message before it is scrambled into secret code.
Ciphertext
The unreadable, encrypted version of a message.
Algorithm
The step-by-step mathematical procedure for encryption.
Remember: Public keys can be shouted from the rooftops. Private keys must be guarded like your own life.
Digital Trust Slides Verified Identity
Digital Trust
Certificate Authorities and the Web of Trust
The "Imposter" Problem
How do you know that amazon.com is actually Amazon?
In an open network, anyone can create a server and claim to be anyone else. Public keys solve encryption, but they don't solve Identity .
The Spoof
"I have a public key!
Digital Certificates (X.509)
The "Passport" of the modern internet.
What's Inside?
Owner's Domain Name
Owner's Public Key
Expiration Date
The CA's Digital Signature
A certificate binds a specific public key to a verified identity.
Think of it as a wax seal on a letter from a trusted king.
Certificate Authorities (CAs)
Verification
They verify that you actually own the domain you claim.
Signing
They cryptographically sign your cert with their private key.
OS Integration
Browsers come pre-loaded with "Root CAs" they trust by default.
The Chain of Trust
Root Certificate Authority (Pre-installed)
Intermediate CA
End-Entity Certificate (e.g. Google.com)
"Your computer trusts the CA, and the CA trusts the website.
Chain of Trust Organizer The Chain of Trust
Digital Identity Mapping
SUBJECT: NETWORK SECURITY
UNIT 1.3: TRUST MODELS
Student Name
Date
Root Certificate Authority (CA)
Trusted implicitly by your Operating System or Browser manufacturer.
Intermediate CA
Authorized by the Root CA to issue certificates on their behalf.
End-Entity (The Website)
e.g. yourbank.com, google.com, school.edu
Pre-Installed Trust
"Built-in list of vetted organizations."
Delegated Power
"Allows for easier scaling of verification."
Verified Proof
"The identity of the server you are visiting."
Trust Breakdown Scenario
A hacker successfully breaks into a Root CA server and creates a fake certificate for "bankofamerica.com".
Explain why this is more dangerous than a hacker creating a fake certificate on their own personal computer.
The "Revocation" Check
If a private key is stolen, the CA publishes a list of certificates that are no longer valid. What is this list called?
Check Your Browser!
Click the lock icon on a secure site. View the certificate details. What is the name of the CA that issued the certificate?
CA Investigation Guide CA Investigation Guide
Teacher Inquiry Resource // Lesson 1.3
The Investigation Objective
The goal of this inquiry is for students to move beyond the abstract concept of "trust" and see the actual mathematical proofs (certificates) that their browsers use daily. By the end of this session, students should be able to identify the CA for any website they visit and understand the chain of command.
STEP 01
The "Lock" Hunt
Instruct students to go to a major website (e.g., wikipedia.org or google.com ). Have them click the padlock icon in the address bar.
Key Questions to Ask:
What does the browser say about the connection? (Usually "Connection is secure")
Click "Certificate is valid". Who issued this certificate? (Common answers: DigiCert, Let's Encrypt, GTS CA)
Why didn't Wikipedia issue their own certificate?
STEP 02
Finding the "Roots"
Open the browser's settings (e.g., Chrome -> Privacy and security -> Security -> Manage certificates). Show them the "Trusted Root Certification Authorities" list.
Teacher Insight:
"Students are often shocked to find hundreds of CAs they've never heard of (from Turkey, China, Brazil, etc.) are implicitly trusted by their computer. This leads to a great discussion about who decides who is trustworthy."
STEP 03
The Failure Case
Show a screenshot or find a site with an "Expired Certificate" or "Self-Signed Certificate" error.
Scenario
A site's certificate expired yesterday.
Discussion Point
Is the site necessarily malicious? Or just poorly maintained?
Complement with "Chain of Trust Organizer" student worksheet.
End of Inquiry
Secure Handshake Slides The Handshake
SSL / TLS Protocol
Client
Server
HTTP + SSL/TLS = HTTPS
HTTP
The language of the web. By default, it is Cleartext. Anyone can read it.
SSL/TLS
The "Security Envelope". It wraps HTTP in a layer of strong math.
3 Goals of HTTPS
Encryption (Privacy)
Authentication (Identity)
Data Integrity
Step 1: The Intro
"HELLO"
Client Hello
The browser says: "I want to talk. Here is a list of encryption algorithms I support."
Server Hello
The server replies: "Let's use AES-256. Also, here is my Certificate and Public Key."
"First, we agree on the rules and verify identity."
Step 2: Key Exchange
"SECRET KEY"
The Premaster Secret
The browser creates a random string. It encrypts this using the server's Public Key .
Decryption is Impossible
Now, both sides use that random string to generate a Session Key .
This Session Key is Symmetric (Fast and efficient for streaming data).
The Result
The conversation is now fully encrypted with a symmetric key that nobody else has.
The browser is certain of the server's identity because of the CA-signed certificate.
[ CONNECTION SECURE ]
Handshake Builder Worksheet The Handshake Builder
Activity 1.4: Protocol Sequencing
PORT: 443 (HTTPS)
The Protocol Challenge
Below are the out-of-order steps of an SSL/TLS handshake. Your mission is to sequence them correctly (1-7) and identify which type of encryption (Symmetric or Asymmetric) is being used in that specific step.
Name:
Date:
Order The Handshake Event Crypto Type
|
Server Hello & Certificate
The server chooses a cipher and sends its digital certificate + public key to the browser.
|
|
|
|
Encrypted HTTP Data Exchange
Both sides begin sending actual website data (HTML, images, CSS) wrapped in the session key.
|
|
|
|
Session Key Generation
Both sides use the random premaster secret to calculate the exact same secret session key.
|
|
|
|
Premaster Secret Sent
The browser creates a random number, encrypts it with the server's public key, and sends it back.
|
|
|
|
Certificate Verification
The browser checks with a Root CA to make sure the server's certificate is legitimate and trustworthy.
|
|
|
|
Client Hello
The browser reaches out to the server and suggests various versions of TLS it is able to use.
|
|
|
|
"Finished" Message
The server sends a finished message encrypted with the session key to prove everything is working.
|
|
Critical Synthesis:
Why does the handshake switch from Asymmetric encryption (using the Public Key) to Symmetric encryption (using the Session Key) halfway through? Why not just use Asymmetric for everything?
Handshake Logic Key Handshake Answer Key
Order Step Description Encryption Type 1 Client Hello None yet (Cleartext) 2 Server Hello & Certificate None (Announcement) 3 Certificate Verification Asymmetric (Verification) 4 Premaster Secret Sent Asymmetric 5 Session Key Generation Internal Math 6 "Finished" Message Symmetric 7 Encrypted HTTP Data Exchange Symmetric
The Synthesis Argument
Answer Guide: Asymmetric encryption (RSA/ECC) is computationally expensive and slow for large amounts of data. It is only used at the beginning to securely transfer a random "premaster secret" without eavesdroppers seeing it. Once both sides have that shared secret, they switch to Symmetric encryption (AES), which is significantly faster and more efficient for streaming high-def video or large files.
"Remind students that 'Asymmetric' is for the key exchange, and 'Symmetric' is for the conversation."
Future Frontiers Slides Future Frontiers
Quantum Computing, IoT, and the Ethics of Encryption
The "Internet of Things"
Billions of devices.
Smart fridges, lightbulbs, and cameras often have no encryption and default passwords. They are perfect targets for Botnets .
The Mirai Botnet
In 2016, 100,000 smart devices took down a massive chunk of the US internet through a DDoS attack.
The Quantum Leap
Shor's Algorithm
Standard computers take millions of years to factorize large prime numbers (breaking RSA).
Quantum Reality
A large-scale quantum computer could factorize those same numbers in seconds.
Post-Quantum Cryptography
"We are currently racing to find new math problems that even quantum computers can't solve."
Lattice-based
Hash-based
The Great Debate: Backdoors
Privacy vs. National Security
The "Safety" Argument
Governments argue they need a "Golden Key" (Backdoor) to decrypt messages from criminals and terrorists to prevent attacks.
PRO-BACKDOOR
The "Privacy" Argument
Cryptographers argue that "there is no such thing as a backdoor that only the good guys can use." If a key exists, it will be stolen.
ANTI-BACKDOOR
How can we communicate privately and securely over a completely public infrastructure?
Unit Complete
Network Security
Up Next
System Design
Security Ethics Debate Cards Security Ethics Debate
Activity 1.5: Philosophical Engineering
ETHICS MODULE
"Encryption is a tool. Like a hammer, it can be used to build a house or break a window. In these debates, we explore who should hold the keys."
1
The "Golden Key"
The Scenario: The FBI asks Apple to create a software "backdoor" to unlock the phone of a known criminal. Apple refuses, saying it would put all other users at risk.
Debate Stances:
Pro: National security is more important than individual privacy.
Con: A backdoor for one is a backdoor for everyone.
2
The IoT Liability
The Scenario: A company sells cheap "smart lightbulbs" with no security. A hacker uses 1 million of these bulbs to launch a DDoS attack on a hospital.
Debate Stances:
Pro: Manufacturers should be legally liable for poor security.
Con: Regulation kills innovation and makes tech too expensive.
3
The Right to be Forgotten
The Scenario: A person made a mistake 10 years ago that is documented online. They want the search engines to delete the links so their past doesn't haunt their job hunt.
Debate Stances:
Pro: Privacy is a human right; people deserve fresh starts.
Con: Deleting history is a form of censorship and hides the truth.
4
Predictive Policing
The Scenario: An AI scans public social media data and private network traffic (metadata) to predict where a crime might happen before it does.
Debate Stances:
Pro: If it saves lives, the loss of metadata privacy is worth it.
Con: This leads to bias and the "presumption of guilt."
Your Synthesis
After hearing the arguments, which scenario do you think has the most clear-cut "right" answer? Which is the most difficult to solve?
