Cybersecurity Roadmap

• Confidentiality: only the intended recipient can read the data.
• Integrity: detect if data was altered.
• Authenticity: verify who the data came from.
• Non-repudiation: the sender cannot deny sending it.

Symmetric encryption uses one shared key to both encrypt and decrypt. It is fast and used for bulk data. AES is the standard algorithm. The challenge is securely sharing the key.

Asymmetric encryption uses a key pair: a public key (shared freely) and a private key (kept secret). Anything encrypted with the public key can only be decrypted with the private key. RSA is the classic example. It solves key distribution but is slower.

A hash function maps any input to a fixed-size output and is one-way and deterministic. The same input always gives the same hash, but you cannot recover the input from the hash. SHA-256 is a common example.

Passwords must never be stored in plaintext or encrypted — they must be hashed with a slow, salted algorithm. A salt is random data added before hashing so identical passwords produce different hashes. bcrypt and Argon2 are designed to be slow, making brute-force attacks expensive.

A digital signature is created with a private key and verified with the corresponding public key. It proves authenticity and integrity: the message came from the key holder and was not altered.

TLS uses asymmetric cryptography to establish a session key, then symmetric encryption for the rest of the connection. This gives the security of asymmetric with the speed of symmetric.

A digital certificate binds a public key to an identity. A Certificate Authority (CA) signs certificates, and browsers trust a set of root CAs. A certificate chain links a site’s certificate up to a trusted root.

• Rolling your own crypto instead of using vetted libraries.
• Storing passwords in plaintext or with reversible encryption.
• Using fast, unsalted hashes for passwords.
• Confusing encoding (Base64) with encryption.
• Reusing keys or nonces inappropriately.