Cryptography Course
(Lecture 1)
Assoc prof . Essam Shaaban
What Is Security?
 “The state of being secure--to be free from danger”
 To be protected from adversaries
 A successful organization should have multiple layers of
security in place:
– Physical security
– Personal security
– Operations security
– Communications security
– Network security
Slide 2
What Is Information Security?
 The protection of information and its critical elements,
including the systems and hardware that use, store, and
transmit that information
 Tools, such as policy, awareness, training, education, and
technology are necessary
 The C.I.A. triangle was the standard based on confidentiality,
integrity, and availability
 The C.I.A. triangle has expanded into a list of critical
characteristics of information
Slide 3
Security Objectives
The value of information comes from the
characteristics it possesses.
– Confidentiality (Data Confidentiality, Privacy)
– Integrity (data integrity, system integrity)
– Availability
– Accuracy
– Authenticity
Slide 4
Components of an Information System
Information System and Information Security
 To fully understand the importance of information security,
you need to know the elements of an information system
 An Information System (IS) is much more than computer
hardware; it is the entire set of software, hardware, data,
people, and procedures necessary to use information as a
resource in the organization
Slide 5
Security Terminology
Vulnerability : A flaw or weakness in a system’s design,
implementation, or operation and management that could be
exploited to violate the system’s security policy.
Threat: A potential for violation of security, which exists when
there is a circumstance, capability, action, or event, that could
breach security and cause harm. That is, a threat is a possible
danger that might exploit a vulnerability.
Attack: An assault on system security that derives from an
intelligent threat; that is, an intelligent act that is a deliberate
attempt (especially in the sense of a method or technique) to evade
security services and violate the security policy of a system.
Security Attacks
 Passive Attacks: attempts to take the information from the system and does
not affect any system resources and its operations
Slide 7
Security Attacks
 Active Attacks: attempts to change the system resources or affect their usual
operations.
Slide 8
Security Attacks
Insider Attack: involves someone from the inside, such
as a disgruntled employee, attacking the network.
Security Attacks
A close-in attack: involves someone attempting to get physically
close to network components, data, and systems in order to learn more
about a network.
Security Attacks
Phishing attack
In phishing attack the hacker creates a fake web site that looks exactly like a popular site. The phishing part of
the attack is that the hacker then sends an e-mail message trying to trick the user into clicking a link that leads
to the fake site. When the user attempts to log on with their account information, the hacker records the
username and password and then tries that information on the real site.
Security Attacks
Hijack attack
In a hijack attack, a hacker takes over a session between you and another individual and
disconnects the other individual from the communication. You still believe that you are
talking to the original party and may send private information to the hacker by
accident.
Security Attacks
Buffer overflow attack
A buffer overflow attack is when the attacker sends more data to an application
than is expected. A buffer overflow attack usually results in the attacker gaining
administrative access to the system in a command prompt or shell.
Security Attacks
Exploit attack
In this type of attack, the attacker knows of a security problem
within an operating system or a piece of software and
leverages that knowledge by exploiting the vulnerability.
Password attack
An attacker tries to crack the passwords stored in a network
account database or a password-protected file.
Security Attacks
Types of password attack
 Dictionary attack: uses a word list file, which is a list of
potential passwords.
 Brute-force attack: is when the attacker tries every possible
combination of characters.
 Hybrid attack: builds on the dictionary attack method by adding
numerals and symbols to dictionary words
OSI Security Architecture
 ITU-T X.800 “Security Architecture for OSI”
 defines a systematic way of defining and providing security
requirements
 for us it provides a useful, if abstract, overview of concepts we
will study
OSI/Reference Model Security Architecture
Aspects of Security
consider 3 aspects of information security:
 Security attack: Any action that compromises the security of information
owned by an organization.
 Security mechanism: A process (or a device incorporating such a
process) that is designed to detect, prevent, or recover from a security
attack.
 Security service: A processing or communication service that enhances
the security of the data processing systems and the information transfers of
an organization. The services are intended to counter security attacks, and
they make use of one or more security mechanisms to provide the service
What is Cryptography?
 Cryptography is the practice of securing information by
transforming it into an unreadable format (encryption) and
converting it back (decryption).
 Found in secure messaging, banking, blockchain, VPNs,
and digital identity verification.
Slide 19
What is Cryptography?
 Caesar Cipher (Classical Cryptography) – A simple shift
cipher used by Julius Caesar.
 Enigma Machine (WWII Cryptography) – Used by
Germany; broken by Alan Turing.
 Modern Cryptography – Digital encryption algorithms
securing online communication.
Slide 20
What is Cryptography?
 Encryption
• The process of converting plain text into ciphertext using
a cryptographic algorithm.
• Example: "HELLO" → Encrypt → "XUBBE" (Caesar
Cipher with shift=16).
Slide 21
What is Cryptography?
Decryption
• The reverse of encryption: converting
ciphertext back into readable plain text.
• Example: "XUBBE" → Decrypt →
"HELLO".
Slide 22
What is Cryptography?
Symmetric Encryption (Private Key)
Asymmetric Encryption (Public Key)
Slide 23
Real-World Applications
 SL/TLS Encryption: Secures web browsing.
 Blockchain and Cryptocurrencies: Bitcoin uses cryptographic
hashing (SHA-256).
 Secure Messaging (End-to-End Encryption): WhatsApp, Signal,
Telegram.
 Digital Signatures & PKI: Used in electronic voting and smart
contracts.
 Password Hashing: Websites store hashed passwords for security.
Slide 24