Skip to content
All cheat-sheets

alphaPlan · Cybersecurity · Cheat-sheet 03

The Vocabulary

Five pairs of words that security people use every day, and the one-line difference that keeps each pair straight.

Ideas to remember

  1. 01Authentication proves who you are; authorization decides what you may do, and the order is always authentication first.
  2. 02Least privilege gives each person and app only the access their job needs, which keeps the blast radius of a stolen password small.
  3. 03Zero trust means checking every request on its own, because being inside the office network is no longer a free pass.
  4. 04Not all data is equal: sort it into public, internal and sensitive, and treat personal data (PII) as sensitive by default.
  5. 05Encryption can be reversed with the right key; hashing is a one-way fingerprint that cannot be turned back.
  6. 06Logs record what happened and monitoring watches for the unusual, so problems get caught in hours rather than months.

Words

Authentication
Proving your identity with something you know, have or are.
Authorization
What the system lets you reach once it knows who you are.
Single sign-on (SSO)
One login with a main provider lets you into many connected apps.
PII
Personally identifiable information: any data that can identify a specific person, alone or combined.
Encryption
Scrambling data so only someone with the right key can read it again.
Hashing
A fixed calculation that turns data into a short fingerprint you cannot work backwards from.

Do this

  • Open one account's settings and find where it proves who you are versus what you are allowed to do.
  • Review the app permissions on your phone and remove one access an app does not need.
  • Label files when you create them, and share sensitive data only with the people who actually need it.
  • Find the padlock in your browser bar and confirm a site is https.
  • Open your email account's login history and confirm every entry is you.

Watch out

  • 'I logged in, so I should see everything' confuses proving identity with being granted access.
  • Access granted for last year's project that nobody removed; permissions pile up quietly.
  • When unsure how sensitive something is, treat it as more sensitive, not less.

From the lessons: Authentication vs authorization, Least privilege and zero trust, Data classification and PII, Encryption vs hashing, Logs and monitoring. codeforalbania.com/en/learn/cybersecurity/03-the-vocabulary

shënim: ky material u krijua në kuadër të projektit 'U.S. Cybersecurity Leadership in AI for Albania', financuar nga departamenti i shtetit i shteteve të bashkuara. mendimet, gjetjet dhe përfundimet e paraqitura këtu janë të autorit(ëve) dhe nuk pasqyrojnë domosdoshmërisht ato të departamentit të shtetit të shteteve të bashkuara.

Disclaimer: This material was created on behalf of the 'U.S. Cybersecurity Leadership in AI for Albania' project, funded by the United States Department of State. The opinions, findings, and conclusions stated herein are those of the author(s) and do not necessarily reflect those of the United States Department of State.

Disclaimer

Found something unclear, outdated or improvable? Suggest an improvement