Cybersecurity and Information Assurance
Core concepts
Master the CIA triad (confidentiality, integrity, availability) plus authentication, authorization, and non-repudiation. Know cryptographic primitives: symmetric (AES, DES), asymmetric (RSA, ECC), hashing (SHA family, MD5 weaknesses), digital signatures, and PKI. Distinguish encryption from encoding and hashing.
Study threat categories and attacks: malware (virus, worm, trojan, ransomware), phishing and social engineering, SQL injection, cross-site scripting, man-in-the-middle, denial of service, and password attacks (brute force, dictionary, rainbow tables). Defenses include firewalls, IDS/IPS, access control models (DAC, MAC, RBAC), multi-factor authentication, patching, and security policies. Understand risk as likelihood times impact, and controls as preventive, detective, or corrective. Bhutan's cybersecurity posture and legal frameworks are relevant.
Traps to watch
- Assuming hashing provides confidentiality; it does not, it provides integrity checks.
- Confusing authentication (who you are) with authorization (what you may do).
- Believing symmetric encryption solves key distribution; asymmetric helps here.
- Mixing a worm (self-propagating) with a trojan (disguised malware).
Worked example
A website stores passwords using plain SHA-256. An attacker with a stolen database uses rainbow tables to reverse common passwords. The fix is salting plus a slow hash such as bcrypt, since a unique salt per user defeats precomputed tables. Rule of thumb: never store plaintext or unsalted fast hashes of passwords.