Applications, Data, and Cryptography

You’ll be able to

Explain how access controls protect confidentiality and integrity
Distinguish encryption, hashing, and authentication
Recognize common application attack evidence

Data protection has layers

Applications protect data by controlling who can access it, validating input, encrypting sensitive information, logging important actions, and preserving integrity. One control rarely solves everything: access control, cryptography, secure coding, and monitoring work together.

Worked example

A login form receives the input admin' OR '1'='1 and the server log shows a successful login without the correct password.

1.The likely attack is injection because input appears to alter a query.
2.The vulnerability is treating user input as executable command text.
3.Mitigations include parameterized queries, input validation, least privilege, and logging.
4.The impact includes unauthorized access and possible data disclosure or modification.

Answer: The strongest answer names the attack, identifies the coding weakness, and recommends a control that prevents the input from changing the query structure.

Checkpoint

Which statement about hashing is correct?

Checkpoint

An application hashes passwords with a fast general-purpose hash and no salt. Which change most improves resistance to an attacker who steals the hash file?

Tip

When you recommend encryption, say what it protects: data at rest, data in transit, or both. That small phrase often turns a vague answer into a scored one.

Answer the 2 checkpoints as you read.