Chapter 2: Securing Data and Identity

Securing Data and Identity 🔐

Prove who you are, and only get what you need

Your grades, your photos, your messages, your account for every app you use: all of it is data, and all of it is worth protecting. In Chapter 1 you learned how data moves. Now you’ll learn how defenders keep it safe while it moves, while it sits in storage, and while it’s being used.

You’ll also learn how computers decide who you are and what you’re allowed to do. Passwords have done that job for decades, and they’ve done it badly. This chapter shows why, and how newer methods like passkeys fix the biggest problems. Finally, you’ll see how encryption keeps secrets secret, and why a new kind of computer, the quantum computer, has the whole security world preparing for change.

2.1 — The CIA Triad and When It Fails 🔺

Security professionals describe their goals with three words that form the CIA triad. (It has nothing to do with the spy agency.)

Goal	Question It Asks	Protected By
Confidentiality	Can only the right people see it?	Passwords, passkeys, encryption, permissions
Integrity	Is it accurate and unchanged?	Backups, version history, digital signatures, permissions
Availability	Is it there when people need it?	Backups, redundancy, updates, protection from attacks that flood systems

What Failure Looks Like

The triad is easiest to understand when one side breaks. Imagine a school’s online gradebook:

Confidentiality fails: a student guesses a teacher’s password and sees everyone’s grades. Private information is exposed, and it can’t be “un-seen.”
Integrity fails: someone changes a grade from a C to an A, or a software bug quietly scrambles some scores. Now no one can trust the gradebook, even the correct entries.
Availability fails: the gradebook crashes the night before report cards are due, or ransomware locks it. The data may be perfectly private and accurate, but it’s useless if no one can reach it.

Notice that the effects ripple. One integrity failure in a gradebook can affect report cards, scholarships, and trust between families and the school. That’s why defenders treat all three goals as equally important.

The Goals Can Pull Against Each Other

Sometimes protecting one side weakens another. Locking a file behind five passwords is great for confidentiality but bad for availability if the one person who knows them is sick. Good security finds the balance: strong enough to protect, easy enough that people can still do their work.

2.2 — Data in Three States 💾

Data is always in one of three states, and each state faces different threats. A defender protects all three.

State	What It Means	Example	Threats	Protections
At rest	Stored and not moving	Files on a laptop, photos in the cloud	Theft of a device, stolen accounts, deleted files	Device encryption, strong logins, backups
In transit	Moving across a network	A message being sent, a page loading	Eavesdropping on public Wi-Fi, fake websites	HTTPS and other encryption, trusted networks
In use	Open and being worked on	A document you’re editing, a game in memory	Shoulder surfing, malware reading memory, screenshots	Locking your screen, updated software, privacy screens

Notice that encryption protects data at rest and in transit, but data in use usually has to be readable so you can work with it. That’s why locking your screen when you walk away matters so much.

Data Loss: Causes and Consequences

Data loss means information is destroyed, corrupted, or can’t be reached. It happens for many reasons:

Hardware failure: hard drives and SSDs eventually wear out.
Human error: deleting the wrong folder or saving over a file.
Theft or loss: a laptop left on a bus.
Ransomware: malware that encrypts files and demands payment.
Disasters: fire, flood, or a power surge.

The consequences range from losing one essay to a business that can’t operate. Organizations also worry about the other kind of data loss: data leakage, when sensitive information escapes to the wrong people.

A Prevention Strategy

The best defense against losing data is a backup, and a popular rule for doing it well is the 3-2-1 rule:

3 copies of important data,
on 2 different kinds of storage,
with 1 copy kept somewhere else (off-site or in the cloud).

Backups only count if they work, so organizations test them by actually restoring files. To stop leakage, many organizations also use data loss prevention tools that notice when sensitive information, like a list of student ID numbers, is about to be emailed outside the school, and block it.

2.3 — Authentication and Authorization 🪪

When you log in, two separate questions get answered, and mixing them up causes real security failures.

authentication asks: Who are you?
authorization asks: What are you allowed to do?

Think of a concert. Showing your ticket and ID at the gate is authentication. Your wristband color decides whether you can enter the backstage area. That’s authorization.

Three Kinds of Proof

Authentication uses one or more factors:

Factor	What It Is	Examples
Something you know	A secret in your memory	Password, PIN
Something you have	An object you own	Phone, security key, school ID card
Something you are	A part of your body	Fingerprint, face

Using two or more different factors is called multi-factor authentication (MFA). A thief who steals your password still doesn’t have your phone.

Biometrics vs. Passwords

	Passwords	Biometrics (fingerprint, face)
Can be forgotten?	Yes, often	No
Can be shared or guessed?	Yes, easily	Very hard
Can be changed if stolen?	Yes	No, you only have one face
Privacy concerns	Low	Higher, because body data is personal

On most phones and laptops, your fingerprint or face data stays on a secure chip inside the device. It isn’t sent to every website. The biometric simply unlocks the device, which then proves who you are. That’s a big reason biometrics have become so common.

Authentication Failure or Authorization Failure?

Defenders investigate incidents by asking which question was answered wrong:

A student signs in using a teacher’s stolen password. The system thought the student was the teacher. That’s an authentication failure.
A student signs in correctly with their own account but can open the folder of test answers because it was shared with the whole school. The system knew exactly who they were and let them in anyway. That’s an authorization failure.

The fix for authorization failures is the principle of least privilege: every person gets only the access they need to do their job, and nothing more.

Passwords have a basic weakness: they’re secrets you type. Anything you type can be typed somewhere else too. The most common attacks on accounts all take advantage of that:

Phishing: a fake login page tricks you into typing your password, and the attacker collects it.
Credential stuffing: a password leaked from one website is tried on many other websites, which works whenever people reuse passwords.
Password guessing: common passwords like 123456 are tried against many accounts.
Server breaches: a company’s password database is stolen.

Even MFA codes sent by text message can be phished, because a fake page can ask for the code too.

What a Passkey Does Differently

A passkey replaces your password with a pair of mathematically linked keys:

When you create a passkey, your device makes a private key, which never leaves your device (or your secure password manager), and a public key, which goes to the website.
When you sign in, the website sends a random challenge.
You unlock your device with your fingerprint, face, or PIN, and the device uses the private key to sign the challenge.
The website checks the signature with your public key. If it matches, you’re in.

This is called cryptographic authentication: you prove you have the key without ever sending it.

Why It Resists Attacks

Attack	Why a Passkey Stops It
Phishing	The passkey is tied to the real website’s address, so your device refuses to use it on a look-alike site
Credential stuffing	Every passkey is unique to one website; there’s nothing to reuse
Password guessing	There’s no password to guess
Server breach	The server only has public keys, which are useless for signing in

Hardware security keys, small USB or tap-to-connect devices, work the same way and are used by many companies for their most sensitive accounts. Apple, Google, and Microsoft all support passkeys, and more websites add them every year.

2.5 — Encryption and the Quantum Question 🔐

encryption turns readable data (plaintext) into scrambled data (ciphertext) using a key. Without the key, the ciphertext is useless. Encryption is what protects your messages in transit and your files at rest.

Two Families of Encryption

Symmetric encryption uses the same key to lock and unlock. It’s very fast, so it’s used for large amounts of data, like everything on a laptop’s drive. The common standard is called AES. The challenge is sharing the key safely in the first place.
Public-key encryption uses a pair: a public key anyone can use to lock a message, and a private key only the owner can use to unlock it. It solves the key-sharing problem. You already met it inside passkeys.

When you visit an HTTPS website, both families work together. Public-key methods let your browser and the website agree on a secret key, then fast symmetric encryption protects the rest of the conversation.

Classical vs. Quantum Computers

Every computer you’ve used is a classical computer. It stores information in bits, and each bit is either 0 or 1. A quantum computer uses qubits. A qubit can be in a superposition, a combination of 0 and 1 at once, and qubits can be entangled, linked so that measuring one tells you about another. For certain problems, this lets a quantum computer explore possibilities in ways no classical computer can.

Quantum computers are not faster at everything. They won’t run your games better or load web pages faster. Most of today’s machines must be kept colder than outer space, are very sensitive to noise, and make many errors. Researchers are steadily building bigger and more reliable ones.

Why Encryption Needs Updating

Here’s the concern. Today’s public-key encryption is safe because certain math problems, like finding the factors of a huge number, would take classical computers far too long. A large, reliable quantum computer running Shor’s algorithm could solve those problems quickly, breaking common public-key methods. No quantum computer can do that yet, but attackers can “harvest now, decrypt later”: steal encrypted data today and wait.

Symmetric encryption is affected differently. A quantum method called Grover’s algorithm speeds up guessing keys, but only enough to weaken them, not break them. Using longer keys, like AES with 256-bit keys, keeps symmetric encryption strong.

	Public-Key Encryption	Symmetric Encryption
Quantum threat	Could be broken by a large quantum computer	Weakened, not broken
The fix	Switch to new post-quantum methods	Use longer keys

That’s why governments and tech companies are already moving to post-quantum cryptography: new public-key methods built on math problems that quantum computers aren’t known to solve quickly.

Chapter 2 Activity: Identity and Data Defense Lab 🧪

Your Mission: You’re the security team for an imaginary middle school called Riverside. Complete the lab on paper or in a school-approved document. Use only made-up names and data.

Part 1: Triad Incident Reports

Write three short incident reports for Riverside: one where confidentiality fails, one where integrity fails, and one where availability fails. For each, describe who is affected and one control that would have prevented it.

Part 2: Three States Map

List five kinds of data Riverside keeps (for example, the lunch account list). For each, write where it is at rest, how it travels in transit, and when it is in use, plus one threat and one protection for each state.

Part 3: Who Got In?

Read each case and label it an authentication failure or an authorization failure: (a) a student uses a classmate’s password; (b) every teacher can edit the principal’s budget; (c) a parent receives a phishing email and enters their password on a fake page. Then write the fix for each.

Part 4: Passkey Pitch

Write a one-paragraph proposal convincing Riverside to switch staff accounts to passkeys. Name two password attacks it stops and explain why, and add one sentence about why the school should start planning for post-quantum encryption.

Key Concepts Checklist

I can explain the CIA triad and the effects of a failure on each side
I can describe data at rest, in transit, and in use, with a threat to each
I can name causes of data loss and explain the 3-2-1 backup rule
I can tell authentication from authorization and spot which one failed
I can compare biometrics with passwords
I can explain how passkeys use cryptographic keys to stop phishing and credential stuffing
I can compare symmetric and public-key encryption
I can explain how quantum computers differ from classical ones and why public-key encryption needs updating