Cybersecurity & Global Impact
@egeuysall · May 6, 2026
@egeuysall · May 6, 2026
This is the entire exam guide for Module 11: Cybersecurity & Global Impact.
Definition: Information about an individual that identifies, links, relates, or describes them.
Examples of PII:
Benefits of PII in computing innovations:
Harmful effects / concerns:
Free apps and websites make money by collecting and selling your data; your email, location, behavior, and preferences are sold to advertisers. You are the product. This is not a bad business model; it is highly profitable.
Data packets travel through many routers on their way to a destination; just like a postcard passes through many post offices. Anyone along that route can read a postcard (or an unencrypted packet). This is why encryption is essential on the internet.
Definition: Fraudulent emails or websites designed to trick you into giving up sensitive information (passwords, credit card numbers, PII).
Red flags in phishing emails:
| Term | Definition |
|---|---|
| Keylogging | Recording which keys are pressed on a keyboard, used to steal passwords and sensitive input |
| Malware | Any software with malicious intent; includes viruses, spyware, ransomware, adware |
| Rogue Access Point | A fake WiFi network with an identical (or similar) name/password to a legitimate network, used to intercept data from unsuspecting users |
| Social Engineering | Psychologically manipulating people into revealing confidential information; sounds natural but is a scam |
| Virus | A self-replicating program that attaches to and infects files; spreads to other devices |
| Ransomware | Malware that locks/encrypts your files and demands payment to restore access |
| Threat | Defense | | | - | | Virus | Antivirus software, avoid unknown downloads | | Malware | Keep software updated, use antivirus | | Keylogging | Antivirus, avoid sketchy apps | | Phishing | Verify links, don't click unknown sources | | Social engineering | Don't trust urgency, always verify identity | | Rogue access point | Avoid unknown or duplicate WiFi networks |
| Term | Definition |
|---|---|
| Identification | Claiming who you are (e.g., entering a username) |
| Authentication | Verifying that claim (e.g., password, fingerprint, MFA code) |
| Authorization | Determining what a verified user is allowed to do (permissions) |
| Principle of Least Privilege | Grant users/systems only the minimum permissions needed; nothing more |
A breach is always a security incident, but a security incident is not always a breach.
Hackers first attack common or previously breached passwords; using databases of known leaked passwords (e.g., from haveibeenpwned.com). This is far easier than cracking a new password from scratch.
Definition: Requiring two or more independent factors to verify identity.
Three factor categories:
Why MFA is more secure than single-factor: Even if a password is stolen, the attacker still needs physical access to the second factor (e.g., your phone). This dramatically reduces the chance of unauthorized access.
Pros: Much stronger security. Cons: Slower login process, dependency on a second device, privacy concerns.
| Term | Definition |
|---|---|
| Encryption | Transforming readable data (plaintext) into an unreadable form (ciphertext) so others cannot read it |
| Decryption | Reversing encryption; converting ciphertext back into readable plaintext |
| Cracking | Decrypting ciphertext without authorization (without possessing the key) |
| Algorithm | The method/process used to encrypt (e.g., Caesar cipher, RSA) |
| Key | The specific value used within an algorithm (e.g., shift of 3, a keyword, prime numbers) |
| | Symmetric | Asymmetric | | -- | | -- | | Keys | Same key for encrypt and decrypt | Public key encrypts, private key decrypts | | Example | Caesar cipher, Vigenere cipher | RSA | | Drawback | Must securely share the key first | Slower, more complex |
DH is a key exchange protocol, NOT encryption. It allows two parties to agree on a shared secret key over a public (insecure) channel without ever transmitting the key itself. That shared key is then used in a symmetric encryption algorithm.
MOD is a one-way function; easy to compute forward, computationally hard to reverse. Even if an eavesdropper knows p, g, and the public values A and B, they cannot feasibly determine the private keys a or b.
Publicly agreed upon: prime number p, generator number g
Alice's private key: a
Bob's private key: b
Alice computes and sends: A = g^a mod p
Bob computes and sends: B = g^b mod p
Alice computes shared key: K = B^a mod p
Bob computes shared key: K = A^b mod p
Both arrive at the same K.A = 11^6 mod 23 = 1771561 mod 23 = 11 → Alice sends 11 to Bob
B = 11^5 mod 23 = 161051 mod 23 = 7 → Bob sends 7 to Alice
Alice: K = 7^6 mod 23 = 117649 mod 23 = 4
Bob: K = 11^5 mod 23 = 161051 mod 23 = 4
Shared secret key K = 4 ✓Once K is established, it is used as the key in a symmetric cipher (like Caesar or Vigenere) to actually encrypt messages.
Example (from journal): K=4, message = "I have the key"
RSA is a type of asymmetric encryption that uses:
The sender (Bob) does NOT need the receiver's (Alice's) private key. He only needs her public key to send a secure message. Only Alice can decrypt it using her private key.
| | Diffie-Hellman | RSA | | -- | | - | | Purpose | Key exchange only | Encryption + authentication | | Authentication | No; vulnerable to MITM | Yes; provides authentication | | Key type | Symmetric shared secret result | Asymmetric public/private key pair |
Step 1: Choose two prime numbers p and q
Step 2: n = p × q
Step 3: m = (p-1)(q-1)
Step 4: Choose e → smallest integer where: 1 < e < n AND gcd(e, m) = 1
(start testing from e=2 upward)
Step 5: Find d → smallest integer where: (e × d) mod m = 1
Step 6: Public key = (n, e)
Private key = (n, d)Encrypt: C = H^e mod n (H = original message value, C = ciphertext)
Decrypt: H = C^d mod nn = 7 × 11 = 77
m = (7-1)(11-1) = 6 × 10 = 60
e = 7 (test: gcd(2,60)=2 ✗, gcd(3,60)=3 ✗, gcd(4,60)=4 ✗, gcd(5,60)=5 ✗, gcd(6,60)=6 ✗, gcd(7,60)=1 ✓)
Public key = (77, 7)
Encrypt: C = 2^7 mod 77 = 128 mod 77 = 51
Find d: (7 × d) mod 60 = 1
Test d=43: 7 × 43 = 301, 301 mod 60 = 1 ✓
Private key = (77, 43)
Decrypt: H = 51^43 mod 77 = 2 ✓A trusted third party that issues digital certificates, which verify that a public key actually belongs to who it claims to belong to. This solves the MITM problem in RSA by authenticating the public key owner.
RSA provides authentication (proves who you're talking to), whereas DH only creates a shared key with no identity verification.
Steganography: Hiding the existence of a message so that others don't even know a secret is being communicated. The message is concealed within a cover medium (like an image).
| Encryption | Steganography | |
|---|---|---|
| Goal | Make message unreadable | Hide that a message exists |
| Visibility | Ciphertext is visible; people know something is encoded | The hidden message is invisible; people see only the cover image |
| Used together? | Often combined for maximum security | Yes; can encrypt a message then hide it with steg |
Every pixel in an image is represented in binary. For example:
00100100
↑ least significant bit (LSB)To hide data, you change only the last 1–2 bits of each pixel's binary value. This causes an imperceptible change to the image visually, but encodes message data.
Example; encoding "cat":
Original pixel: 11111111
Hidden bit: 1111111[1] ← last bit changed to encode messageAlways use lossless compression (e.g., PNG) when working with LSB steganography.
If the hidden message is clearly visible in the output image, she is modifying too many bits or using bits that are too significant. Fix:
A = g^a mod p (Alice's public value)
B = g^b mod p (Bob's public value)
K = B^a mod p (Alice computes shared key)
K = A^b mod p (Bob computes shared key)Setup:
n = p × q
m = (p-1)(q-1)
e = smallest int where gcd(e, m) = 1 and 1 < e < n
d = smallest int where (e × d) mod m = 1
Encrypt: C = H^e mod n
Decrypt: H = C^d mod nEncrypt: shift each letter right by key k
Decrypt: shift each letter left by key kEncrypt: for each letter i, shift by keyword[i mod len(keyword)]
Decrypt: reverse the shifts using the same keyword| Concept | Key Point |
|---|---|
| PII | Identifies/describes a person; valuable to companies, risky if breached |
| Free apps | You pay with your data, not money |
| Internet as postcard | Unencrypted data can be read by anyone along the route |
| Phishing | Fake emails/sites; watch for bad domains, suspicious links, urgency |
| Keylogging | Records keystrokes to steal passwords |
| Malware | Any harmful software |
| Rogue access point | Fake WiFi to intercept traffic |
| Social engineering | Psychological manipulation to extract info |
| Identification | Claiming identity |
| Authentication | Proving identity |
| Authorization | What you're allowed to do |
| Principle of least privilege | Minimum permissions necessary |
| Security incident vs. breach |
| Incident: something went wrong. Breach: data confirmed stolen |
| Symmetric encryption | Same key to encrypt and decrypt (Caesar, Vigenere) |
| Asymmetric encryption | Public key encrypts, private key decrypts (RSA) |
| Caesar cipher | Letter shift; cracked by brute force (25 combos) |
| Random substitution | Random letter replacement; cracked by frequency analysis |
| Vigenere cipher | Keyword shifts; cracked by finding keyword length then frequency analysis |
| Encryption vs. key | Algorithm = the method; key = the specific value used |
| Diffie-Hellman | Key exchange protocol (NOT encryption); creates shared secret via one-way modular arithmetic |
| DH disadvantage | Vulnerable to MITM; no authentication |
| RSA | Asymmetric encryption; public key encrypts, private key decrypts; provides authentication |
| RSA security | Hard to crack because it requires factoring huge primes; computationally hard |
| Certificate authority | Verifies ownership of public keys via digital certificates |
| Steganography | Hides that a message exists (vs. encryption which hides content) |
| LSB steganography | Changes last 1–2 bits of pixel binary; imperceptible change |
| Compression for steg | Must use lossless (PNG); lossy destroys LSBs |
| MFA | 2+ factors: know/have/are; stronger but slower |
| Strong password | Random, mixed case + numbers + symbols, 8+ chars, not breached |
| Low-hanging fruit | Hackers target common/breached passwords first |