Day 2: Foundations and Strong Passwords

CyberQuest Summer Camp - day deck

This is your hands-on companion to the main course deck. The main deck (Interactive_Slides.html) sends you to specific Parts here and to Modules in the notebook, then back. You can also run this deck on its own, top to bottom, with the Next arrow.

Morning Kickoff: Motivation & News (09:00 AM - 09:15 AM)

• Case Profile: The 2024 Change Healthcare Ransomware Attack. Cybercriminals exploited an unauthenticated entry portal, halting health payment infrastructure nationwide. This underscores why missing security controls present catastrophic operational risks.

Teaching Session I: Core Lecture (09:15 AM - 11:15 AM)

Cybersecurity Governance Terminology

• Asset: Any high-value resource, hardware appliance, or data segment owned by an organization (e.g., patient health records).
• Threat: Any potential event or entity capable of causing harm or unauthorized access to an asset (e.g., a ransomware gang).
• Vulnerability: A flaw or operational weakness in system architecture, software code, or physical access controls that can be exploited by an attacker.
• Risk: The mathematical probability that a specific threat will exploit a vulnerability, multiplied by the operational impact or financial loss (Risk = Probability x Impact).
• Security Assessment: A comprehensive technical evaluation of an infrastructure's defensive posture to identify vulnerabilities before attackers do.

The Threat Actor Spectrum

• White Hat Hackers: Security professionals who perform penetration testing with legal authorization to help defend networks.
• Black Hat Hackers: Malicious cybercriminals who breach infrastructure unlawfully for financial gain or disruption.
• Gray Hat Hackers: Individuals who find vulnerabilities without authorization but report them without malicious intent, operating outside strict legal boundaries.
• Script Kiddies: Amateurs who launch pre-made exploit tools and scripts without understanding their underlying code mechanics.
• Hacktivists: Politically or ideologically motivated actors who deface web systems or leak files to draw attention to a social cause.

Legal Frameworks and Core Governance Matrix

• Ethical Hacking Rules: Requires explicit written permission, a clearly defined scope of testing targets, and adhering to responsible disclosure policies by reporting vulnerabilities privately to owners.
• Computer Fraud and Abuse Act (CFAA): The primary United States federal computer crime statute. It criminalizes accessing a protected computer system without authorization or exceeding authorized access bounds.

The CIA Security Triad Core Properties

• Confidentiality: Ensuring data is accessible only to authorized entities. Attacks include Brute-Force Password Cracking.
• Integrity: Safeguarding data from unauthorized modification or tampering.
• Availability: Ensuring information networks are reliably accessible to users. Attacks include Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) attacks, which flood bandwidth to crash systems.

Teaching Session II: Labs & Interactive Tools (11:45 AM - 01:45 PM)

Practical Interactive Tools for Today

1. Google Interland: Complete gamified interactive paths focused on evaluating threat links, phishing recognition, and risk management parameters.
2. Security.org Password Tool: Input testing phrases to see how expanding character lengths affects brute-force cracking time metrics.

Recap & Tomorrow's Horizon (04:15 PM - 04:30 PM)

• Summary: Today we broke down risk, mapped threat profiles, analyzed the CFAA, and explored how brute-force and DDoS attacks disrupt the CIA Triad.
• Tomorrow Preview: We will explore defensive mechanics, covering encoding, hashing, encryption, and strategies to resist social engineering.

Your plan for today

6 parts. Press Next to move in order.

1. Part 1. Get oriented - 4 slides
2. Part 2. Learn the basics - 25 slides
3. Part 3. Code along - 1 slide
4. Part 4. Play the free tools - 3 slides
5. Part 5. Test yourself - 4 slides
6. Part 6. Wrap up - 1 slide

PART 1 OF 6

Get oriented

Objectives, key terms, a picture, and the news.

This part is 4 slides. Press Next to begin.

Learning objectives

• State the three goals of security (the CIA triad).
• Explain why password length beats complexity.
• Use a password tester responsibly and estimate crack time.

Vocabulary (acronyms expanded and defined)

• CIA triad = Confidentiality, Integrity, Availability: keep data secret, keep it correct, keep it reachable.
• MFA = Multi-Factor Authentication: proving who you are with two or more things (a password plus a phone code).
• 2FA = Two-Factor Authentication: MFA with exactly two factors.
• PIN = Personal Identification Number: a short numeric code.
• Phishing: a fake message that tricks you into giving up a password.
• Keyspace: the total number of possible passwords; bigger is harder to guess.
• Brute force: trying every possible password until one works.

Picture it

  Something you KNOW (password)
  Something you HAVE (phone, key)   ->  combine two = Multi-Factor Authentication
  Something you ARE  (fingerprint)

In the news (real and verifiable)

Every year, password managers such as NordPass publish a list of the most common passwords, and weak choices like 123456 and password appear at the top again and again. These take well under a second for a computer to guess. The lesson security pros repeat: length and unpredictability matter far more than swapping an a for an @.

PART 2 OF 6

Learn the basics

Now go deeper: the core ideas step by step, with quick knowledge checks.

This part is 25 slides. Press Next to begin.

The CIA triad

Three goals of security

• Confidentiality: keep data secret.
• Integrity: keep data correct.
• Availability: keep data reachable.

CIA = Confidentiality, Integrity, Availability.

Knowledge check

The C in the CIA triad stands for...

Why length beats tricks

The math of keyspace

Possible passwords = N to the power L, where N is the character set size and L is the length.

26 ** 8  = lowercase, 8 long
95 ** 12 = all symbols, 12 long  (vastly larger)

Adding length grows the keyspace far faster than swapping a for @.

Knowledge check

Which password is stronger?

Multi-Factor Authentication

A second lock on the door

• Something you KNOW: a password.
• Something you HAVE: a phone or key.
• Something you ARE: a fingerprint.

MFA = Multi-Factor Authentication. Even if a password leaks, the attacker still needs the second factor.

Knowledge check

MFA improves security because...

The CIA triad

Illustration

Every attack breaks a corner; every defense protects one.

CIA in real life

One example each

Confidentiality: a leaked customer database exposes private data.

Integrity: changing a grade or a bank balance without permission.

Availability: a denial-of-service flood takes a site offline.

Knowledge check

Ransomware locks a hospital's files so staff cannot open them. Which pillar breaks?

Authentication factors

Three ways to prove who you are

MFA combines two or more of these.

Brute force versus MFA

Attack vs Defense

A password is one door. MFA adds a second door the attacker does not have.

Keyspace, explained

Why size matters

The number of possible passwords is N to the power L, where N is how many characters are allowed and L is the length. Adding length raises the exponent, which grows the total far faster than adding character types.

How long to crack?

Rough times at a billion guesses per second

* Assumes an offline attack against unsalted hashes at 1 billion guesses per second. Rate limiting and salted hashing vastly increase these estimates.

Knowledge check

Which is hardest to crack?

Password do and do not

Simple rules

Do: use long passphrases, a different password per site, and a password manager.

Do not: reuse passwords, use names or birthdays, or share them. Never type a real password into a tester.

Password managers

One strong password to rule them all

A password manager generates and stores a unique strong password for every site, locked behind one master password. You only memorize the master one, and the manager fills the rest.

Passphrases

Easy to remember, hard to crack

Four random words like correct-horse-battery-staple are long and unpredictable. Length plus randomness beats a short complicated password and is easier to type.

Why a salt matters

Illustration

The same password becomes two different fingerprints, so one table cannot crack many accounts.

Hashing

A one-way fingerprint

A hash like SHA-256 turns any input into a fixed-length fingerprint that cannot be reversed. Sites store the hash of your password, so a database leak does not reveal the password itself.

Salting

Random, per-user

A salt is random text added before hashing, unique to each user. It stops attackers from using precomputed tables (rainbow tables) and from cracking many identical passwords at once.

Turning on MFA

The single best account upgrade

In site security settings, enable two-factor authentication, then approve it with an authenticator app or a code. After that, a stolen password alone cannot log in.

Anatomy of a phishing email

Spot the red flags

• Urgency: act in 24 hours or lose access.
• Generic greeting: Dear Customer.
• Look-alike link: paypa1.com uses a 1 for the l.
• Unexpected attachment or a request for your password.

Social engineering types

Tricking people, not computers

Knowledge check

Your bank calls and asks you to read back the code they just texted. Safe?

Breach lessons

Why today matters

The biggest breaches often begin with a weak or reused password or a single phishing click. Strong passwords, MFA, and spotting phishing, the skills from today, prevent the most common real attacks.

The CIA vs DAD triads

Ch 1 §1.2 — foundational security principles

Two sides of the same coin

The Parkerian Hexad

Ch 1 §1.3 — extending the CIA triad

Three extra properties beyond CIA

Parkerian Hexad = CIA + Authenticity + Utility + Possession. Used in legal and insurance contexts where "available but uncontrolled" matters.

Knowledge check

A hacker steals a database of passwords. Which CIA property is primarily violated?

Threat actor taxonomy

Ch 1 §1.5 — who are the adversaries

Who attacks and why?

Quantifying risk: the ALE formula

Turning threats into dollars

Risk = probability x loss is the simplified form. The formal version breaks it into SLE (Single Loss Expectancy) x ARO (Annualized Rate of Occurrence) = ALE. Both express the same idea: expected annual cost.

Three terms you need:

Password entropy: a numeric view

Ch 1 §1.8 — authentication and access control

Why longer passwords win

Entropy (bits) = length × log2(alphabet size)

import math
alphabet = 95          # all printable ASCII (including space)
length   = 12
combos   = alphabet ** length
print(f"combinations: {combos:.2e}")   # 5.40e+23

A GPU cracker runs ~10 billion (10¹⁰) SHA-256 guesses per second. Against ~5×10²³ combinations, time ≈ ~5×10¹³ seconds ≈ 1.7 million years.

CFAA: legal vs. illegal

The Computer Fraud and Abuse Act (1986, updated 2008)

Knowledge check

Using the ALE formula: asset value $100,000, exposure factor 50%, ARO 1. What is the ALE?