16.6 Cybersecurity: The Five Pillars, Strong Passwords, Security Strategies, and Trade-offs
Key Takeaways
- The five pillars of cybersecurity are confidentiality (only authorized access), integrity (no unauthorized changes), availability (accessible when needed), authentication (verifying identity), and nonrepudiation (a party cannot deny an action).
- Logging in with a stolen username and password compromises authentication, because the system accepts a false claim of identity.
- Password strength grows with length and with the size of the character set: a random character from 95 printable symbols adds about 6.6 bits, so 12 such characters give about 79 bits.
- A distributed denial-of-service (DDoS) attack differs from a denial-of-service (DoS) attack mainly in the number of computers launching it: many compromised machines instead of one.
- Digital signatures, made with the sender's private key, provide integrity, authentication, and nonrepudiation; certificates from trusted authorities bind a public key to an identity, at the cost of managing keys, renewals, and trust.
What this competency asks
Two ETS competencies are covered here:
- Be familiar with digital and physical strategies for maintaining security: identify characteristics of strong passwords (for example, length and bits per character); identify digital and physical security strategies; identify trade-offs in the use of security measures (for example, encryption, decryption, digital signatures, and certificates).
- Be familiar with concepts of cybersecurity: identify and define the five pillars: confidentiality, integrity, availability, nonrepudiation, and authentication.
ETS's sample questions ask which pillar is compromised when someone logs in with a stolen login and password (authentication), and how a DDoS attack differs from a DoS attack (the number of computers launching the attack).
The five pillars
| Pillar | Definition | Threat example | Defense example |
|---|---|---|---|
| Confidentiality | Only authorized people can read the information | Eavesdropping on Wi-Fi; a data breach | Encryption; access controls |
| Integrity | Information is not altered without authorization, and changes are detectable | A grade changed by an intruder; a tampered download | Hashes and checksums; digital signatures; permissions |
| Availability | Systems and data are accessible when needed | DDoS attack; ransomware; hardware failure | Redundancy; backups; DDoS protection |
| Authentication | Verifying that users, devices, or senders are who they claim to be | Stolen or guessed passwords; phishing | Multi-factor authentication; strong passwords; certificates |
| Nonrepudiation | A party cannot credibly deny having sent a message or performed an action | A sender claims "I never approved that" | Digital signatures; secure audit logs |
The first three are often called the CIA triad. Classify a scenario by asking what went wrong: someone saw data (confidentiality), changed data (integrity), blocked access (availability), pretended to be someone else (authentication), or denied an action they took (nonrepudiation).
Strong passwords
An attacker who tries every possibility (brute force) needs up to (number of possible characters)^(length) guesses. It is often expressed in bits:
bits ≈ length × log₂(size of character set)
| Character set | Size | Bits per character |
|---|---|---|
| Digits only | 10 | about 3.3 |
| Lowercase letters | 26 | about 4.7 |
| Upper- and lowercase letters | 52 | about 5.7 |
| All printable keyboard symbols | 95 | about 6.6 |
- 8 random lowercase letters: 8 × 4.7 ≈ 38 bits.
- 12 random characters from all 95 symbols: 12 × 6.6 ≈ 79 bits.
- Every added bit doubles the guessing work, so length is the most powerful lever.
These numbers assume random choices. Human-chosen passwords such as Summer2026! are far weaker than their length suggests, because attackers try dictionary words, names, dates, and common substitutions first.
Characteristics of strong passwords: long (a passphrase of several random words works well), unpredictable, unique for every account, not based on personal information, and stored in a password manager. Pair them with multi-factor authentication (MFA), which combines something you know (a password), something you have (a phone or security key), and something you are (a fingerprint). Two passwords are still only one factor.
Common threats
| Threat | Description |
|---|---|
| Phishing | Deceptive messages that trick people into revealing credentials or running malware |
| Malware | Viruses (attach to files and need a user action to spread), worms (spread on their own across networks), trojans (disguised as useful software), ransomware (encrypts data and demands payment), spyware |
| DoS / DDoS | Flooding a service to make it unavailable. DoS comes from one source; DDoS comes from many sources, often a botnet of compromised computers and IoT devices |
| Man-in-the-middle | Intercepting or altering communication between two parties |
| SQL injection | Malicious input that changes a database query; prevented by parameterized queries and input validation (Section 11.2) |
| Social engineering | Manipulating people: pretexting phone calls, tailgating through doors |
Digital and physical security strategies
| Digital strategies | Physical strategies |
|---|---|
| Strong, unique passwords and MFA | Locked server rooms and network closets |
| Prompt software and firmware updates | Badge or key access; visitor sign-in |
| Firewalls, which filter network traffic by rules | Security cameras and alarms |
| Antivirus and anti-malware | Cable locks for laptops; secure carts for devices |
| Encryption of devices and connections (HTTPS, WPA3) | Screen locks and privacy screens |
| Least privilege: give each user only the access they need | Shredding printed records; clean-desk policies |
| Regular, tested backups (Section 14.3) | Device inventory and secure disposal of old drives |
| Network segmentation, such as a separate guest Wi-Fi | Preventing tailgating through secure doors |
| Security awareness training | Protecting power (UPS) and the environment (fire, heat) |
Defense in depth layers several independent controls, so one failure does not expose everything.
Digital signatures and certificates
- A digital signature is created by hashing a message and signing the hash with the sender's private key. Anyone can verify it with the sender's public key. It provides integrity (any change breaks the signature), authentication (only the key holder could sign), and nonrepudiation (the signer cannot credibly deny it).
- A digital certificate is issued by a trusted certificate authority (CA). It binds a public key to an identity, such as a website's domain. Browsers check certificates for HTTPS, which lets you trust that you reached the real site.
Trade-offs in security measures
| Measure | Benefit | Trade-off |
|---|---|---|
| Encryption and decryption | Confidentiality at rest and in transit | Processing time and battery use; key management; data lost if keys are lost; harder to scan traffic for malware (Section 13.4) |
| Digital signatures | Integrity, authentication, nonrepudiation | Private keys must be protected; if a key is stolen, forged signatures look valid; verification requires trusted public keys |
| Certificates and certificate authorities | Trusted identities on the Web | Certificates expire and must be renewed; a compromised or careless CA can issue fraudulent certificates; costs and administration |
| Multi-factor authentication | Stops most attacks that use stolen passwords | Extra steps for users; account recovery gets harder if a device is lost |
| Strict password rules | Harder brute-force attacks | Users write passwords down or reuse them if the rules are burdensome |
| Monitoring and logging | Detects attacks; supports nonrepudiation | Privacy concerns; storage costs |
| Blocking and filtering | Reduces exposure | Can block legitimate resources and frustrate users |
The general tension is security versus usability, cost, and performance. A good answer chooses measures in proportion to the value of the data and the likely threats.
An attacker obtains a teacher's username and password from a data breach and uses them to log in to the school's grading system. Which pillar of cybersecurity is compromised at the moment of login?
What primarily distinguishes a distributed denial-of-service (DDoS) attack from a denial-of-service (DoS) attack?
Assuming each password is chosen completely at random, which has the most possible combinations and is therefore hardest to brute-force?
A principal digitally signs a policy document with a private key. Later, the principal claims never to have approved the document. Which pillar does the digital signature most directly support in this dispute?
Which is a physical security strategy for protecting a school's student-information server?
You've completed this section
Continue exploring other exams