Information security

The goal: the CIA triad

• Confidentiality — only authorised parties can read the data.
• Integrity — the data hasn't been altered.
• Availability — it's there when it's needed.

Cryptography

• Symmetric (e.g. AES): one shared secret key encrypts and decrypts — fast, but distributing the key safely is hard.
• Public-key / asymmetric (e.g. RSA): a public key encrypts and the matching private key decrypts — no shared secret needed.
• Hash (e.g. SHA-256): a one-way fingerprint of data; you can't reverse it back to the original.

Digital signature

Sign by encrypting a hash of the message with your private key; anyone can verify it with your public key. This proves both integrity (unchanged) and authenticity (really from you).

Common attacks

• Phishing / social engineering — tricking a person, not the system.
• Malware — virus, worm, trojan, ransomware.
• SQL injection and cross-site scripting (XSS) — abusing unvalidated input.
• DoS / DDoS — flooding a service so it can't respond.