Tutorial 1
Information asset is anything that has value to an organisation and requires protection.
Examples in a university context:
- Students personal data
- University Lecturer contact number
a. Confidentiality: ensure that the information is accessible only to authorized
individuals
b. Integrity: ensuring that information remains accurate and unaltered
c. Availability: ensuring the information and systems are accessible when needed
- Confidentiality: data breach, privacy violation
- Integrity: Incorrect information, loss of trust
- Availability:service disruption, operational downtime
a. Integrity
b. The record is being altered and loss of organisational trust
a. Availability
b. Having backup system
User accidentally deletes files: Human threats
Hacker installs malware: Human threats
Server hardware failure:Technical threats
Flood damages data centre:Environment threats
Because if ignore one of this, security incidents will still occur
a. Security risk
b. Reducing vulnerabilities in system,implementing security controls,monitoring systems
for potential attacks and improving users awareness and training
Threats: any object, person or event that has the potential to cause the harm to an
environment
Vulnerability:weakness or flow in an environment system that can be exploited by a threat
agent
1. Confidentiality: Password login
2. Integrity: Bank transaction amount
3. Availability: ATM working
Tutorial 2
1. Explain the meaning of cryptography and state its main purpose in information security
Cryptography is the practice of securing information by converting it into an unreadable form.
Main purpose:
(1) Supports multiple security goals to ensure trusted and secure communication
- Ensure data is accessible only to authorized users
- Ensure data is not altered or tampered
2. Differentiate between plaintext, ciphertext, encryption, and decryption.
Plaintext: the original, readable message before any security is applied
Ciphertext: The scrambled, unreadable message after encryption
Encryption: The process of converting plain text into ciphertext using an algorithm/key
Decryption: The process of converting ciphertext back into plaintext using a key
3. Compare symmetric encryption and asymmetric encryption
Feature Symmetric Asymmetric
Keys Used One key Two keys (public + private)
Speed Fast Slower
Security Depends on key screcy More secure for key
exchange
Usage Encrypt large data Key exchange,
authentication
4. Why is key management important in cryptography?
1. Protects sensitive data
Even if you use strong encryption, if the key is exposed, anyone can decrypt the data.
👉 “Strong lock, but key left outside = useless.”
2. Prevents unauthorized access
Proper key management ensures only authorized users can access or decrypt information.
3. Ensures secure key distribution
Keys must be shared safely between sender and receiver.
If intercepted during transmission, attackers can read all messages.
5. A company wants to protect customer data stored in a database. Should it use symmetric
or asymmetric encryption for the actual stored data? Justify your answer.
Symmetric encryption is more suitable because it is:
● Faster and more efficient → important for encrypting large amounts of database data
● Less computationally expensive compared to asymmetric encryption
● Designed for bulk data encryption
6. What is a hash function? How is hashing different from encryption?
Hash function: converts data into a fixed -size hash value
Hasing is one-way function (cannot be reversed), it is used for integrity and security
7. Explain how digital signatures help in secure communication.
- Sender creates a hash of the message
- Hash is encrypted using the sender’s private key → digital signature
- Receiver decrypts it using the sender’s public key
- Compares hashes to verify authenticity and integrity
8. Describe briefly how HTTPS uses cryptography to secure web communication.
- Clients initiates HTTPS connection: Browser requests secure connection
- Server sends digital certificate: Contains public key; signed by certificate authority
(CA)
- Client verifies certificate: Checks CA signature; confirms servers identity
- Session key is established: Using asymmetric encryption; shared securely between
client & server
- Secure communication begins: using symmetric encryption
9. A student sends a password through plain email without encryption. What risks may
occur? Suggest a better approach.
(a) Risk of Sending Password via Plain Email
❌ Risks:
Eavesdropping → attackers can intercept and read the password
Data leakage → email servers may store the message insecurely
Account compromise → attacker can log in using the stolen password
Man-in-the-middle attacks → password can be captured during transmission
✅ Better Approach:
Use encrypted communication (HTTPS)
Send sensitive data through secure platforms instead of email
Store passwords using hashing (e.g., bcrypt)
Use multi-factor authentication (MFA)
10. Give one real-life example for each of the following: 1. Symmetric encryption 2.
Asymmetric encryption 3. Hashing 4. Digital signature
1️⃣ Symmetric Encryption
👉 Example:
Encrypting files using a password (e.g., ZIP file with password)
👉 Same password is used to:
encrypt 🔒
decrypt 🔓
2️⃣ Asymmetric Encryption
👉 Example:
HTTPS websites (online banking login)
👉 Browser uses:
server’s public key to encrypt data
server uses private key to decrypt
3️⃣ Hashing
👉 Example:
Password storage in websites
👉 When you create a password:
system stores hashed password, not the original
4️⃣ Digital Signature
👉 Example:
Signing a PDF document or software download verification
👉 Ensures:
sender is authentic
file is not modified
🎯 Short Answer Version (for exams)
Symmetric encryption: File encryption using a password
Asymmetric encryption: HTTPS secure communication
Hashing: Password storage in systems
Digital signature: Signed documents/software verification