Skip to main content
CSP LabBy Educator Today
AP CSP course

C70 · Topic 5.6 · 40 minutes · IOC-2.A, IOC-2.B, IOC-2.C

Choosing appropriate protections

By the end you can:

  • Match authentication, encryption and minimisation to threats.
  • Distinguish symmetric and public-key roles.
  • Explain why safeguards have boundaries.

Before this lesson: topics 4.1, 5.1.

Authentication
Checking a claimed identity before granting access.
Confidentiality
Keeping information from parties not authorised to read it.
Data minimisation
Collecting or retaining only the information needed for a justified purpose.

Understand

Authentication controls access, while encryption protects readable content from parties lacking the necessary key. Symmetric encryption uses a shared secret key for encryption/decryption. In a simplified public-key confidentiality model, a sender encrypts for a recipient using the recipient’s public key and the recipient decrypts using its private key; do not confuse a public key with a secret everyone must hide.

Appropriate encrypted transport can protect content in transit, and stored-data/device encryption can reduce exposure in a loss scenario. Neither automatically protects data after an authorised application decrypts it on a compromised endpoint. MFA, careful navigation, updates, access limits and data minimisation address different mechanisms; choose a relevant combination and state remaining risks instead of claiming one measure solves every threat.

Worked example

Compare a stolen-password login, interception in transit and a lost locked device.

  1. MFA can reduce stolen-password-only access; storing encrypted records does not stop all authorised-looking sessions.
  2. Transport encryption targets readable traffic in transit; endpoint compromise can still expose content.
  3. Suitable stored/device encryption can reduce loss exposure, but an unlocked or already compromised device may remain accessible.

Explore each concept

Choose a concept, change its inputs and follow the explanation. Each example models the stated rule or scenario; completing it is practice rather than evidence of mastery.

  • Encryption versus authentication
  • Shared-key versus key-pair roles
  • Certificate trust and endpoint limits
Open this example on its own

Change it · step through · explain

Change an input, predict what will happen, then advance one step. Read why the state changes, reset and experiment. This fixed teaching model does not save progress or award XP.

Ready · Make a prediction

Ready to explore: Symmetric keys, public keys and certificates
  1. ApproachsymmetricWaiting
  2. Attempted decrypt keyrecipient-privateWaiting

Ready to explore: Symmetric keys, public keys and certificates

Why: Change an input, predict the first effect, then advance one step.

Try this: Change one input or choose another listed case. Predict the effect, reset and compare the states and governing rule.

Step through and experiment

Change it · step through · explain

Change an input, predict what will happen, then advance one step. Read why the state changes, reset and experiment. This fixed teaching model does not save progress or award XP.

Ready · Make a prediction

Ready to experiment
  1. Input 1phishingWaiting
  2. Input 2mfaWaiting

Ready to experiment

Why: Predict the first change, then advance one step.

Try this: Keep the threat fixed and compare safeguards. Which mechanism directly addresses it?

Check a misconception

Claim: Encryption is the same as authentication and prevents every type of attack.

They address different goals, and the protection boundary must match the threat.

Guided practice

Explain which key is kept secret in the simplified public-key confidentiality model.

Work with a partner. Make a prediction, compare your reasoning, then identify the rule that supports your answer.

Independent transfer

Match phishing,password-only login,interception and unnecessary retention with relevant protections and a limitation.

Exit check

Why can a valid encrypted connection still lead to harm if the user gives data to an untrusted recipient?

Write your reasoning before comparing with a classmate. If your teacher assigned this task, submit it through My classes to save your work and receive feedback.

Check yourself

  1. Question 1 of 2Which key decrypts a message encrypted for a recipient using that recipient’s public key in the stated model?

    Select one answer.

  2. Question 2 of 2Which TWO statements are justified?

    Select exactly two answers (0 of 2 selected).

Your practice so far

Check an answer to see its rationale.

Teacher guidance and scoring