Cybersecurity Basics

What this covers

• Applying the CIA triad (confidentiality, integrity, availability) to judge which property a given incident actually broke
• Classifying malware and attack types — viruses, worms, trojans, ransomware, keyloggers, DoS — by how they spread and what they do
• Analysing phishing and social engineering: spotting spoofed sender addresses, mismatched link targets, urgency cues and pretexting
• Comparing symmetric and asymmetric encryption, including why public-key exchange solves the key distribution problem, with Caesar and substitution ciphers as warm-ups
• Explaining password hashing, salting and why sites can reset but never reveal your password; estimating how length beats symbol-substitution against brute force
• Distinguishing authentication, authorisation and multi-factor methods (something you know / have / are), plus how firewalls and HTTPS fit into layered defence

Where learners get stuck

Treating hashing as a kind of encryption that can be 'decrypted' with the right key

Both turn readable text into scrambled output, so students assume both are reversible. The one-way property only clicks once you work through why a login system compares hashes rather than recovering the original password, and why leaked hash databases are cracked by guessing, not by decrypting.

Assuming the padlock icon or 'https' means a website is safe and legitimate

Schools and online safety talks push 'look for the padlock' as a rule of thumb without saying what it certifies. HTTPS guarantees the connection is encrypted and the certificate matches the domain — an attacker's phishing site can obtain a valid certificate for their own lookalike domain in minutes.

Believing a short password with symbol substitutions (P@ssw0rd!) is stronger than a long simple passphrase

Complexity rules on signup forms imply that character variety is what matters. Once you compare search-space sizes, it's clear that added length multiplies the work far faster, and that common substitutions are the first thing cracking tools try.

What a session looks like

A session runs as spoken back-and-forth. Evelyn typically opens with a scenario — a leaked customer database, a text message claiming your parcel is held, a school Wi-Fi login page — and asks you to say what was compromised and how. You'll be pushed to name the specific mechanism rather than say 'they got hacked': which of confidentiality, integrity or availability failed, whether the weak point was technical or human, and what control would have stopped it. Ciphers and hashing are worked through out loud with small examples you can hold in your head, and Evelyn will restate your explanation back with a deliberate error for you to catch. You can bring a worksheet, a case study or exam-style question and work through it line by line.

Helpful to know first

• Comfortable using a browser, email and file system — you should know what a URL, a domain name and a file extension are
• Basic arithmetic with powers and multiplication for reasoning about key sizes and password search spaces
• A rough idea that computers connect over networks and send data in packets; no networking course required
• No programming experience needed — this topic is separate from the Python and web development strands

Questions

Does this teach hacking or how to use hacking tools?

No. Sessions cover how attacks work conceptually so you can defend against them and answer exam questions. There is no instruction in using penetration testing software, writing malware, or attacking any real system or account.

Is this useful for a Cambridge IGCSE, GCSE Computer Science or Computing Fundamentals security unit?

The content maps to the security topics common to those courses — malware types, social engineering, authentication, encryption, firewalls and data protection principles. Evelyn Tutor is not affiliated with any exam board, so check your specification for the exact terminology and case studies your paper expects.

My child is in 9th grade and hasn't done any coding. Can they still take this?

Yes. Cybersecurity Basics is the least code-dependent topic at this level. Everything is explained through scenarios, diagrams described in words, and small hand-worked cipher examples.

How is this different from the online safety lessons they already get at school?

School e-safety sessions usually give behaviour rules — don't share passwords, report bullying. This topic explains the machinery underneath: why a salted hash defeats a rainbow table, why public-key encryption lets strangers exchange secrets, what a firewall actually inspects. It's assessed knowledge, not just guidance.