Chapter 1 — Security foundations for practitioners
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 Three goals"]
N3["1.3 One control among many"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 Three goals"]
N3["1.3 One control among many"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 The case]
|
v
[1.2 Three goals]
|
v
[1.3 One control among many]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) describe the confidentiality, integrity and authenticity goals that cryptography serves; (2) place cryptography among other controls; (3) introduce the managed-service case used throughout the book.
1.1 The case
Dana Whitlock has just joined the fictional managed-service provider Copperleaf Managed Services as a junior security analyst on a six-month professional programme. Her mentor is Marcus Oyelaran, a lead analyst. Copperleaf's main client in this book is the fictional Bayside Dental Group, which runs four clinics with a patient booking website, a practice-management database, staff laptops, an email service and card payments through an outside processor. Every person, company, system and number here is synthetic. Dana's job is to run repeatable checks, record evidence and explain findings clearly to the clinic manager, not to design new cryptography.
1.2 Three goals
Marcus explains cryptography through three goals. Confidentiality keeps patient records and booking details readable only by authorised people. Integrity makes unauthorised changes detectable, for example to an invoice or an X-ray report. Authenticity confirms who sent or signed something, such as a payment notification from the processor. Availability matters too, but cryptography can harm it, for instance when a certificate expires or a disk-encryption key is lost. Dana learns to ask which goal a control serves before judging it, because encryption alone does not prove who sent a message and a signature alone does not hide its content.
1.3 One control among many
Cryptography protects data in transit and at rest, but it cannot fix a stolen password, an unpatched server or a receptionist tricked into sending files. At Bayside, the booking website uses TLS, laptops use full-disk encryption and backups are encrypted, yet the biggest recent incident was a phishing email. Dana learns to place cryptographic findings in context: an expired certificate may be urgent because patients see warnings, while a strong cipher setting adds little if every staff member shares one administrator password. Good practitioners report cryptographic issues with their real weight, neither inflated nor dismissed.
Worked example
Dana maps Bayside's five main services to the three goals and notes which existing controls are cryptographic and which are not.
Synthetic case. Copperleaf, Bayside Dental Group, Dana and Marcus are invented.
Errors and limits
The three goals simplify; some mechanisms serve several at once. Context changes priority, so a checklist cannot rank findings alone.
Exercises
- EX001 — Analyst duties. What does Dana's role at Copperleaf involve? Rubric: 3 = running repeatable checks, recording evidence and explaining findings, not designing cryptography;; 2 = partial;; 1 = designs ciphers;; 0 = none.
- EX002 — Signature and secrecy. Does a digital signature on an invoice keep it confidential? Rubric: 3 = no; it gives integrity and authenticity, not confidentiality;; 2 = says no;; 1 = says yes;; 0 = none.
- EX003 — Harm to availability. Give one way cryptography can reduce availability. Rubric: 3 = expired certificate or lost encryption key;; 2 = one example;; 1 = vague;; 0 = none.
- EX004 — Biggest incident. What was Bayside's biggest recent incident, and what does it teach? Rubric: 3 = phishing; cryptography is one control among many;; 2 = names phishing;; 1 = names cipher;; 0 = none.
- EX005 — Weighting findings. Why might an expired certificate outrank a cipher setting? Rubric: 3 = patients see warnings and service fails; impact matters more than theoretical strength;; 2 = impact;; 1 = always equal;; 0 = none.
Synthesis
Practitioners judge each cryptographic control by the goal it serves and its real weight among all of a client's controls.