Harvard CS50's Introduction to Cybersecurity: Full Course

Understanding Cybersecurity Threats and Defenses

• 💡 Cybersecurity is viewed not in absolute terms but as a function of risks and rewards for adversaries versus costs and benefits for users.
• ⚠️ The goal is to raise the bar for adversaries by increasing their costs and risks, thereby decreasing their potential reward and potentially losing their interest.
• 🛡️ While prevention is important, detection through auditing and monitoring is crucial for minimizing downsides when adversaries do gain access.

Securing Accounts: Authentication and Authorization

• 🔑 Authentication is the process of proving who you are, typically using a username and password.
• ⚖️ Authorization determines whether you should have access to something once your identity is proven.
• 🔒 Passwords are the primary defense, but they are vulnerable to dictionary attacks (guessing common words) and brute force attacks (trying all possible combinations).
• 🔢 A four-digit passcode has only 10,000 possibilities (10^4), making it extremely vulnerable to brute force attacks, taking mere milliseconds to crack.
• 🔠 Using four letters (uppercase and lowercase) increases possibilities to 52^4 (approx. 7 million), still crackable in seconds.
• 🔑 Combining letters, digits, and punctuation (94 possibilities) for an eight-character password significantly increases complexity, leading to quadrillions of possibilities (94^8), making brute force attacks impractical.

NIST Recommendations and Best Practices

• 📜 NIST recommendations emphasize memorized secrets (passwords) of at least eight characters.
• 🔗 Websites should permit passwords of at least 64 characters using ASCII and Unicode characters, including spaces.
• 🚫 Passwords should not be easily guessable, repetitive, sequential, or context-specific (e.g., using the service name).
• ⚠️ Rate limiting on authentication attempts (e.g., locking an account after multiple failed attempts) slows down adversaries and increases the risk of them being caught.
• 🔐 Two-factor authentication (2FA) adds a second factor beyond knowledge (password), such as possession (phone) or inherence (biometrics), significantly decreasing the probability of unauthorized access.
• 📱 One-time passwords (OTPs), often delivered via SMS or apps, are a common form of possession factor, but SMS-based OTPs are less secure due to SIM swapping risks.

Advanced Threats and Defenses

• 🦠 Malware, including keyloggers, can record keystrokes and upload them to adversaries, potentially compromising passwords and OTPs.
• 🔗 Credential stuffing involves using stolen credentials from one breach to attempt access on other websites.
• 🎣 Phishing uses social engineering via convincing emails or websites to trick users into revealing sensitive information.
• 🚫 Social engineering preys on trust and psychological manipulation to gain information or access.
• ⚠️ Man-in-the-middle attacks intercept communications between two parties, potentially altering data or stealing information if encryption is not properly implemented.
• 🔒 HTTPS and TLS encrypt traffic between browsers and servers, preventing eavesdropping and data alteration.
• 🛡️ Firewalls act as barriers, controlling network traffic based on IP addresses, port numbers, or deep packet inspection.
• 🔑 VPNs encrypt all internet traffic between the user and the VPN server, masking the user's IP address and providing a secure tunnel.
• 🧅 Tor (The Onion Router) provides enhanced anonymity by routing traffic through multiple encrypted relays, making it difficult to trace the origin.
• 💻 Passkeys offer a passwordless future, using public/private key cryptography managed by devices (phone, computer) for authentication.

Data Security: Hashing, Encryption, and Digital Signatures

• 🗄️ Hashing converts data into a fixed-length, seemingly random string (hash value), making it difficult to reverse. It's used for password storage to protect against data breaches.
• 🧂 Salting adds a unique random value to each password before hashing, ensuring that even identical passwords produce different hashes, preventing rainbow table attacks and information leakage.
• 🔒 Encryption (symmetric and asymmetric) scrambles data using keys, making it unreadable without the correct key.
• 🔑 Secret key cryptography (symmetric) uses the same key for encryption and decryption, requiring a secure way to share the key.
• 🔑 Public key cryptography (asymmetric) uses a pair of keys: a public key for encryption and a private key for decryption. This solves the key distribution problem.
• ✍️ Digital signatures use a private key to sign a hash of data, allowing verification with the corresponding public key, ensuring authenticity and integrity.
• 🔐 Passkeys leverage public/private key cryptography for passwordless authentication, generating unique key pairs for each website.
• 🛡️ End-to-end encryption ensures data is encrypted from sender to receiver, preventing intermediaries (even service providers) from accessing the content.
• 🗑️ Secure deletion involves overwriting data with random patterns or zeros/ones to prevent recovery, unlike simply deleting files which only removes them from the file system index.
• 🔒 Full disk encryption encrypts all data at rest on a device, protecting it if the device is lost or stolen, provided the device is locked.