CIA Triad & Authentication Fundamentals
Confidentiality, Integrity, Availability — Understanding public key cryptography and password security
Scenario: You're a cybersecurity analyst for a financial institution. Your job is to protect customer data using the three pillars of information security. Understanding these fundamentals will help you implement proper authentication and encryption systems.
🛡️ The CIA Triad
Click on each pillar to explore how it protects information:
Select a CIA pillar above to see detailed examples and threats
🎯 CIA Threat Simulator
🔑 Symmetric vs Asymmetric (Public Key) Cryptography
📌 Scenario
You're a developer who needs to give a teammate remote access to a production server — without ever emailing them a password. You also need to encrypt customer records at rest as fast as possible. These two problems require different types of cryptography. Understanding when to use symmetric vs asymmetric encryption is one of the most practical skills in cybersecurity.
🔒 Encrypt with Key A
🔓 Decrypt with Key A
🔒 Encrypt with Bob's Public Key
🔓 Decrypt with Bob's Private Key
💡 Why this matters in practice
Use Symmetric when:
- Encrypting large files or databases
- Both parties already share a key securely
- Speed is critical (AES is ~1000× faster than RSA)
Use Asymmetric when:
- Establishing a secure connection for the first time
- Authenticating identity (digital signatures)
- Sharing a symmetric key safely over the internet
🔐 Real-world example: HTTPS uses asymmetric encryption (RSA/ECDH) only to exchange a temporary symmetric key, then switches to AES for the rest of the session — getting the best of both worlds.
🖥️ Try it yourself — Generate Your Own Key Pair
Your browser detected you're on . The correct commands are pre-selected below. Open your terminal and run them to create a real RSA key pair.
▶ How to open Terminal on macOS
Terminal, press Enterssh-keygen -t rsa -b 4096 -C "your.email@example.com"
# 2. View your PUBLIC key — safe to share with anyone
cat ~/.ssh/id_rsa.pub
# 3. View your PRIVATE key — never share this!
cat ~/.ssh/id_rsa
📸 Upload Your Terminal Screenshot
After running the commands above, take a screenshot of your terminal showing both the public and private key output. Upload it here as proof of completion.
🔐 Why Do We Have Passwords?
Authentication: Passwords verify "you are who you say you are"
Without authentication, anyone could access your accounts, files, and sensitive information.
🧪 Password Generator Task
Use a password generator to create three passwords — one for each strength level — then paste them in the fields below. Each field will validate your entry and show you the estimated crack time.
Short password — under 8 characters (e.g. hello123)
Mix of letters & numbers, 8–11 characters (e.g. Coffee2024)
12+ characters with uppercase, lowercase, numbers & symbols (e.g. T!ger$8x#Mango)
⚠️ Password Vulnerabilities
- Dictionary attacks (using common words)
- Brute force attacks (trying all combinations)
- Social engineering (guessing personal info)
- Data breaches (passwords stolen from other sites)
❓ Which CIA principle is MOST violated when an attacker intercepts and reads your encrypted email without authorization?
After interacting with the CIA triad, public key concepts, and password strength tools, reflect on your learning:
- What does each pillar of the CIA triad protect against — and can you give a real-world example for each?
- How does public key cryptography solve the key distribution problem that symmetric encryption cannot?
- Why is password length generally more important than complexity when it comes to brute-force resistance?
- What is the difference between authentication and authorization? Why does it matter?
- Key question: An attacker intercepts your encrypted email and reads its contents without modifying it. Which CIA principle is violated — and why are the other two not violated in this specific scenario?
🔒 Complete all objectives (tracker bottom-right ↘) to unlock submission
Was there anything within the lab you expected to change, but didn't?
💡 Why it matters
The CIA Triad forms the foundation of all cybersecurity practices:
- Confidentiality — Encryption protects sensitive data from unauthorized access
- Integrity — Hash functions and digital signatures ensure data hasn't been tampered with
- Availability — Redundancy and security measures keep systems accessible to authorized users
Public key cryptography solves the key distribution problem, enabling secure communication over insecure channels. Strong authentication (passwords, multi-factor auth) ensures only authorized users access protected systems.