How it works
Cybersecurity protects systems and data using authentication, encryption, secure communication, updates, backups, and user awareness.
Use HTTPS for secure web traffic, MFA for account protection, and encryption when secrecy is needed.
Common error
Encryption protects confidentiality; it does not by itself prove data is accurate, backed up, or free from bias.
Worked example
Choose a control for a password-phishing risk without claiming that one tool solves every security problem.
Data / pseudocode
Risk: stolen account password
Sensitive action: export saved records
Transport: HTTPS already enabledHTTPS protects suitable data in transit but does not stop a person from sharing a password with an impostor. Use account protection such as MFA, trusted verification and reporting procedures, and limited export privileges. Each control addresses a different part of the risk.
Exercises
4.5.1
Does HTTPS alone prove that the operator of a website is honest? Explain.
Show solution
No. Encrypted transport protects the connection to the identified site under its certificate conditions; a malicious site can also use HTTPS.
4.5.2
Name a control that supports recovery after accidental deletion and a different control that limits who can read stored records.
Show solution
Tested backups support recovery. Appropriate authorization and protected storage limit reading. Recovery and confidentiality are distinct goals.