## Chapter 1 — Security foundations for practitioners ### Learning outcomes You will (1) describe the confidentiality, integrity and authenticity goals that cryptography serves; (2) place cryptography among other controls; (3) introduce the managed-service case used throughout the book. ### 1.1 The case Dana Whitlock has just joined the fictional managed-service provider Copperleaf Managed Services as a junior security analyst on a six-month professional programme. Her mentor is Marcus Oyelaran, a lead analyst. Copperleaf's main client in this book is the fictional Bayside Dental Group, which runs four clinics with a patient booking website, a practice-management database, staff laptops, an email service and card payments through an outside processor. Every person, company, system and number here is synthetic. Dana's job is to run repeatable checks, record evidence and explain findings clearly to the clinic manager, not to design new cryptography. ### 1.2 Three goals Marcus explains cryptography through three goals. Confidentiality keeps patient records and booking details readable only by authorised people. Integrity makes unauthorised changes detectable, for example to an invoice or an X-ray report. Authenticity confirms who sent or signed something, such as a payment notification from the processor. Availability matters too, but cryptography can harm it, for instance when a certificate expires or a disk-encryption key is lost. Dana learns to ask which goal a control serves before judging it, because encryption alone does not prove who sent a message and a signature alone does not hide its content. ### 1.3 One control among many Cryptography protects data in transit and at rest, but it cannot fix a stolen password, an unpatched server or a receptionist tricked into sending files. At Bayside, the booking website uses TLS, laptops use full-disk encryption and backups are encrypted, yet the biggest recent incident was a phishing email. Dana learns to place cryptographic findings in context: an expired certificate may be urgent because patients see warnings, while a strong cipher setting adds little if every staff member shares one administrator password. Good practitioners report cryptographic issues with their real weight, neither inflated nor dismissed. ### Worked example Dana maps Bayside's five main services to the three goals and notes which existing controls are cryptographic and which are not. > **Synthetic case.** Copperleaf, Bayside Dental Group, Dana and Marcus are invented. ### Errors and limits The three goals simplify; some mechanisms serve several at once. Context changes priority, so a checklist cannot rank findings alone. ### Exercises - **EX001 — Analyst duties.** What does Dana's role at Copperleaf involve? *Rubric:* 3 = running repeatable checks, recording evidence and explaining findings, not designing cryptography;; 2 = partial;; 1 = designs ciphers;; 0 = none. - **EX002 — Signature and secrecy.** Does a digital signature on an invoice keep it confidential? *Rubric:* 3 = no; it gives integrity and authenticity, not confidentiality;; 2 = says no;; 1 = says yes;; 0 = none. - **EX003 — Harm to availability.** Give one way cryptography can reduce availability. *Rubric:* 3 = expired certificate or lost encryption key;; 2 = one example;; 1 = vague;; 0 = none. - **EX004 — Biggest incident.** What was Bayside's biggest recent incident, and what does it teach? *Rubric:* 3 = phishing; cryptography is one control among many;; 2 = names phishing;; 1 = names cipher;; 0 = none. - **EX005 — Weighting findings.** Why might an expired certificate outrank a cipher setting? *Rubric:* 3 = patients see warnings and service fails; impact matters more than theoretical strength;; 2 = impact;; 1 = always equal;; 0 = none. ### Synthesis Practitioners judge each cryptographic control by the goal it serves and its real weight among all of a client's controls. ### Continue studying — chapter 01 of 12 [← Course home](../../README.md) · [Course chapter index](../SUBJECTS.md) · [Chapter 02 (draft) →](#ch-02) ## Worked answers **EX001.** Running repeatable checks, keeping evidence and explaining findings to the client, without inventing cryptography. **EX002.** No. A signature shows who signed it and that it is unchanged, but anyone can still read the content. **EX003.** An expired certificate blocks patients from the booking site, and a lost disk-encryption key makes a laptop's data unreadable. **EX004.** A phishing email; it shows that strong cryptography cannot stop people being tricked, so findings need context. **EX005.** Because an expired certificate breaks the service and alarms patients now, while a slightly weaker cipher has little practical impact.