Year 10 Digital Technologies · Digital Systems · 12m read

Cybersecurity — Threats, Encryption and Defence

Cyber attacks hit schools, hospitals and businesses every day. Understanding threats and defences is essential for any digital career.

Learning objective: Analyse cyber threats and evaluate defences including encryption and authentication.

By the end of this lesson you can:

• I can describe common cyber threats.
• I can explain symmetric and public-key encryption.
• I can recommend security controls.

Cybersecurity is defending a castle. Walls (firewalls), guards (authentication), secret codes (encryption) and drills (training) work together. Attackers only need one weak gate.

Cybersecurity — Threats, Encryption and Defence

THREATS:
• Malware (viruses, ransomware, spyware), phishing, social engineering, denial-of-service, weak passwords, unpatched software, data breaches.

ENCRYPTION:
• Converts plaintext to ciphertext.
• SYMMETRIC — same key encrypts and decrypts.
• PUBLIC-KEY (asymmetric) — public key encrypts, private key decrypts; used in HTTPS.

DEFENCES:
• Multi-factor authentication (MFA), strong passphrases and password managers, updates and patching, firewalls, backups (3-2-1 rule), least privilege, user training.

AUSTRALIAN CONTEXT:
• Australian Cyber Security Centre (ACSC) "Essential Eight" mitigation strategies.

| Threat | Defence |
|---|---|
| Phishing | Training, check links, MFA |
| Malware/ransomware | Updates, antivirus, backups |
| Weak passwords | Passphrases, password managers |
| Man-in-the-middle | HTTPS, VPN |
| Social engineering | Verify identity, awareness |

Key ideas at a glance

• Defence in depth: Layers.
• MFA: Something you know + have.
• Patch promptly: Updates fix vulnerabilities.
• Back up (3-2-1): 3 copies, 2 media, 1 offsite.

Worked example (Medium)

Recommend three controls for a school after a phishing incident.

1. MFA. Stops stolen passwords alone from granting access.
2. Training. Staff learn to recognise phishing.
3. Backups. Recover data if ransomware follows.

Answer: MFA, phishing awareness training, and regular offline backups.

Worked example (Medium)

Encrypt "CAT" with a Caesar shift of 3.

1. C→F. +3.
2. A→D. +3.
3. T→W. +3.

Answer: FDW.

Common mistakes

• Relying on antivirus alone Layered defences are needed. Fix: Combine technical and human controls.

Public-key encryption

HTTPS uses asymmetric encryption: a public key encrypts, and only the matching private key decrypts. It solves the problem of sharing secret keys with strangers online.

Practice questions

1. Requiring a password and a phone code is:

   1. Encryption
   2. Multi-factor authentication
   3. A firewall
   4. Phishing

   (1 marks)

2. How does HTTPS protect data?

   (2 marks)

3. MFA stands for:

   1. Multi-factor authentication
   2. Main file access
   3. Malware filter app
   4. Many firewalls active

   (1 marks)

4. Explain the 3-2-1 backup rule.

   (2 marks)

Summary

• Threats: malware, phishing, social engineering.
• Symmetric vs public-key encryption.
• Layered defences and the Essential Eight.
• Layered defences protect systems.