Chapter 2: Protecting Information

Protecting Information 🔐

Keep it secret, keep it right, keep it ready.

Think about all the information that is about you: your name, your birthday, your grades, your doctor visits, your family photos, your game scores. Some of it is fine to share. Some of it should stay private. And all of it should be correct and there when you need it.

That is exactly what cyber defenders protect. In this chapter, you will learn the three goals every defender works toward, how computers decide who is allowed in, why the password is slowly being replaced by something better, and how secret codes keep messages safe as they travel.

2.1 — The CIA Triad 🔺

No, not the spy agency! In cybersecurity, CIA stands for three goals. Together they are called the CIA Triad, because a triad is a group of three. Picture a triangle. If any side breaks, the triangle falls down.

C Is for Confidentiality: Keep It Secret 🤫

Confidentiality means only the right people can see the information. Your report card should be seen by you, your family, and your teachers, not by the whole school. When a stranger reads a private message, confidentiality is broken.

I Is for Integrity: Keep It Right ✅

Integrity means the information is correct and has not been changed by someone who shouldn’t change it. If your spelling score was 95 but somehow it changed to 59, integrity is broken, even if nobody else saw it.

A Is for Availability: Keep It Ready ⏰

Availability means the information is there when you need it. If the school website crashes the night before a big project is due, nobody can get their assignment. Availability is broken.

Sorting Problems Into C, I, or A

What Happened	Which Side Broke?
Someone peeked at a classmate’s password over their shoulder	Confidentiality
A shared story got half its paragraphs deleted	Integrity
The Wi-Fi went down, and nobody can open their files	Availability
A stranger read a family’s emails	Confidentiality
A virus changed numbers in a spreadsheet	Integrity

Changes on Purpose and by Accident

Information can be changed in two ways. By accident: a classmate in a shared document types over your paragraph without meaning to, or a computer crashes while saving. On purpose: someone sneaks into an account and changes a grade, or a harmful program scrambles files.

Defenders protect against both. Some protective measures:

Version history lets you see every change and go back to an earlier version.
“Can view” sharing stops people from editing what they only need to read.
Backups (from Chapter 1) let you restore a file that was wrecked.
Locking your screen stops someone from changing things while you are away.

2.2 — Who Gets In? 🚪

Imagine your school had no front office, no locked doors, and no rules about who could walk into the principal’s office and open the files. Anyone could read anyone’s records! Computers need rules about who gets in, too.

Proving Who You Are

Authentication means proving you are who you say you are. When you sign in to your school laptop, the computer is asking, “Are you really you?” You might prove it with:

Something you know, like a password or PIN
Something you have, like your own phone or a school badge
Something you are, like your fingerprint or your face

Using two of these together is called multi-factor authentication. Even if someone guesses the password, they still don’t have the phone.

Deciding What You Can Do

Once the computer knows who you are, it asks a second question: “What are you allowed to do?” That is Authorization. You can sign in to your school account, but you are authorized to see only your grades, not everyone’s. Your teacher is authorized to see the whole class. The principal may be authorized to see the whole school.

Here is an easy way to remember the difference:

	Question It Answers	Real-World Example
Authentication	Who are you?	Showing your ticket at the movie theater
Authorization	What can you do?	Your ticket lets you into Theater 3, not every theater

The Right Amount of Access

Defenders follow a simple rule: people should get the access they need, and no more. The school nurse needs to see health records to help students, so the nurse has access. Classmates don’t need to see each other’s health records, so they don’t. The cafeteria needs to know about food allergies, but not about grades.

This idea, giving appropriate access to private information, protects everyone. If an account is ever broken into, the attacker can only reach what that one account was allowed to see. Fewer keys handed out means fewer doors left open.

2.3 — Beyond Passwords: Passkeys 🔑

For many years, the password was the main way to protect an account. Passwords still work, but they have some big problems.

Why Passwords Have Trouble

Problem	What Happens
Easy to guess	People pick things like their pet’s name or “123456.” Attackers try common passwords first.
Reused	One password used for many accounts means one leak can open them all.
Tricked away	A fake website that looks real can ask you to type your password, and then the attacker has it.
Peeked at	Someone can watch you type, or find it on a sticky note.
Forgotten	Long, strong passwords are hard to remember, so people write them down or make them short.

Notice something? Many of these problems happen because a password is a secret you have to type. Anything you type can be typed into the wrong place.

Enter the Passkey

A passkey is a newer way to sign in. Instead of a secret you remember and type, a passkey is a secret key that lives on your device, safely locked away. When you sign in, you unlock it with your face, your fingerprint, or your device’s PIN, and your device proves who you are to the website.

Here is why passkeys are so strong:

Nothing to guess. The secret is a very long code made by the device, not a word you picked.
Nothing to type into a fake site. A passkey is made for one real website. If a fake look-alike website asks for it, your device simply won’t use it there.
Nothing useful to steal from the website. The website keeps only a matching “public” half that cannot be used to sign in by itself.
Nothing to forget. Your face or fingerprint is always with you.

Big companies such as Apple, Google, and Microsoft now support passkeys, and many websites offer them. For now, the grown-ups in your life set up accounts and passkeys for your family. But you can be the one who explains why they work!

2.4 — Secret Codes: Encryption 🔐

Remember packets from Chapter 1? On their way across the internet, your messages pass through lots of computers that are not yours. How do you keep a message private when it travels through strangers’ hands?

Scrambling the Message

Encryption means scrambling information so only someone with the right key can unscramble it. A key is the secret rule or number that locks and unlocks the code.

One of the oldest codes is called a shift cipher. You shift every letter forward in the alphabet by a secret number. With a key of 3, A becomes D, B becomes E, and so on:

HELLO becomes KHOOR

Anyone who catches KHOOR sees nonsense. Your friend, who knows the key is 3, shifts each letter back three and reads HELLO.

Where Encryption Protects You

You use encryption every day without noticing:

HTTPS websites scramble everything between your browser and the server.
Many messaging apps scramble messages so only the sender and receiver can read them.
Phones and laptops can scramble everything stored on them, so a stolen device is useless to a thief without the passcode.

That last one is important. Encryption protects information while it travels and while it is stored.

Stronger Computers Need Stronger Codes

Here is a problem with the shift cipher. There are only 25 possible shifts. A patient person with a pencil could try them all in a few minutes, and a computer could try them all instantly. As computers got faster, codes had to get stronger. Today’s encryption uses keys so huge that even the fastest computers we have would need an impossibly long time to guess them.

But remember quantum computers from Chapter 1? Scientists think a powerful enough quantum computer could someday unlock some of today’s codes much faster. So defenders are getting ready now, before that day comes. In 2024, a United States agency called the National Institute of Standards and Technology (NIST) published new encryption standards designed to stay strong even against quantum computers. Companies are already starting to switch.

It is like a town upgrading its locks because a new tool might someday open the old ones. Smart defenders don’t wait for the break-in.

Chapter 2 Activity: The Code Breakers’ Club! 🕵️

Your Mission: Become a secret-code expert and a CIA Triad detective.

Part 1: Secret Messages

With a partner, choose a secret key from 1 to 5. Each of you writes a short, kind message (five words or fewer) and encrypts it with a shift cipher. Trade papers and decrypt each other’s messages. Then trade with a different pair without telling them the key. How long does it take them to crack it by trying every shift? What does that tell you about small keys?

Part 2: CIA Sort

Your teacher will read out problems, like “a website is down” or “someone changed your score.” Hold up one finger for C, two for I, or three for A. Be ready to explain your choice and name one protective measure.

Part 3: Password or Passkey?

Draw two columns. On the left, list the five password problems from section 2.3. On the right, write how a passkey solves each one. Circle the one you think matters most and tell a partner why.

Key Concepts Checklist

I can name the three parts of the CIA Triad and give an example of each
I can sort a problem into confidentiality, integrity, or availability
I can explain how information gets changed by accident or on purpose, and name a protective measure
I know the difference between authentication and authorization
I can explain why people should get only the access they need
I can describe at least three problems with passwords
I can explain how passkeys reduce password risks
I can encrypt and decrypt a message with a shift cipher
I can explain why more powerful computers need updated encryption