Jump to a topic
Chapter approach
This chapter teaches cybersecurity as a defensive discipline. The focus is understanding risk, evidence, controls, and safe response. Any hands-on practice should be performed only on systems and accounts you own or are explicitly authorized to use.
29.1 Hash Functions
Hash Functions protects information or proves integrity using mathematical techniques. A beginner should focus on the purpose of each technique, where keys or secrets live, and what can go wrong if those secrets are exposed.
Beginner picture: Encryption is like locking a box, hashing is like creating a tamper-evident fingerprint, and a digital signature is like attaching a verifiable seal.
Defensive example
A security team is reviewing Hash Functions. Instead of assuming a problem, it first identifies the asset, expected behavior, available evidence, business impact, and the lowest-risk authorized action. This keeps the investigation evidence-based and defensible.
Safe security workflow
- Define the asset, user, service, or data connected to Hash Functions.
- Write the expected normal behavior before deciding that something is suspicious.
- Collect evidence using read-only or low-risk checks whenever possible.
- Choose a defensive action that is authorized, reversible, and proportional to the risk.
- Verify the result, document the change, and escalate when the situation exceeds your role.
Common mistakes
- Treating Hash Functions as a tool-only problem instead of considering people, process, and business impact.
- Making changes before preserving useful evidence or confirming authorization.
- Using one alert, score, or symptom as proof without context.
- Stopping after a technical change without verifying risk reduction or documenting the result.
Authorized practice
Use a private lab, synthetic data, or a paper exercise. Create a scenario involving Hash Functions. List the asset, likely risk, existing control, evidence you would collect, the safest defensive action, and how you would verify success. Do not scan, test, access, or modify systems you do not own or have explicit permission to assess.
29.2 Integrity Checks
Integrity Checks is an important part of Hashing, Integrity, and Signatures. For a beginner, learn four things first: what it protects, what could go wrong, what evidence shows a problem, and what safe defensive action reduces the risk.
Beginner picture: Cybersecurity becomes manageable when a large problem is broken into assets, threats, protections, evidence, and recovery steps.
Defensive example
A security team is reviewing Integrity Checks. Instead of assuming a problem, it first identifies the asset, expected behavior, available evidence, business impact, and the lowest-risk authorized action. This keeps the investigation evidence-based and defensible.
Safe security workflow
- Define the asset, user, service, or data connected to Integrity Checks.
- Write the expected normal behavior before deciding that something is suspicious.
- Collect evidence using read-only or low-risk checks whenever possible.
- Choose a defensive action that is authorized, reversible, and proportional to the risk.
- Verify the result, document the change, and escalate when the situation exceeds your role.
Common mistakes
- Treating Integrity Checks as a tool-only problem instead of considering people, process, and business impact.
- Making changes before preserving useful evidence or confirming authorization.
- Using one alert, score, or symptom as proof without context.
- Stopping after a technical change without verifying risk reduction or documenting the result.
Authorized practice
Use a private lab, synthetic data, or a paper exercise. Create a scenario involving Integrity Checks. List the asset, likely risk, existing control, evidence you would collect, the safest defensive action, and how you would verify success. Do not scan, test, access, or modify systems you do not own or have explicit permission to assess.
29.3 Password Hashing Concepts
Password Hashing Concepts controls who or what may use a system and what actions are allowed afterward. Good security separates proving identity from granting permission, then records important access events.
Beginner picture: A building badge can prove who you are, while door permissions determine where you may go. Digital systems use the same separation.
Defensive example
A security team is reviewing Password Hashing Concepts. Instead of assuming a problem, it first identifies the asset, expected behavior, available evidence, business impact, and the lowest-risk authorized action. This keeps the investigation evidence-based and defensible.
Safe security workflow
- Define the asset, user, service, or data connected to Password Hashing Concepts.
- Write the expected normal behavior before deciding that something is suspicious.
- Collect evidence using read-only or low-risk checks whenever possible.
- Choose a defensive action that is authorized, reversible, and proportional to the risk.
- Verify the result, document the change, and escalate when the situation exceeds your role.
Common mistakes
- Treating Password Hashing Concepts as a tool-only problem instead of considering people, process, and business impact.
- Making changes before preserving useful evidence or confirming authorization.
- Using one alert, score, or symptom as proof without context.
- Stopping after a technical change without verifying risk reduction or documenting the result.
Authorized practice
Use a private lab, synthetic data, or a paper exercise. Create a scenario involving Password Hashing Concepts. List the asset, likely risk, existing control, evidence you would collect, the safest defensive action, and how you would verify success. Do not scan, test, access, or modify systems you do not own or have explicit permission to assess.
29.4 Salts
Salts is an important part of Hashing, Integrity, and Signatures. For a beginner, learn four things first: what it protects, what could go wrong, what evidence shows a problem, and what safe defensive action reduces the risk.
Beginner picture: Cybersecurity becomes manageable when a large problem is broken into assets, threats, protections, evidence, and recovery steps.
Defensive example
A security team is reviewing Salts. Instead of assuming a problem, it first identifies the asset, expected behavior, available evidence, business impact, and the lowest-risk authorized action. This keeps the investigation evidence-based and defensible.
Safe security workflow
- Define the asset, user, service, or data connected to Salts.
- Write the expected normal behavior before deciding that something is suspicious.
- Collect evidence using read-only or low-risk checks whenever possible.
- Choose a defensive action that is authorized, reversible, and proportional to the risk.
- Verify the result, document the change, and escalate when the situation exceeds your role.
Common mistakes
- Treating Salts as a tool-only problem instead of considering people, process, and business impact.
- Making changes before preserving useful evidence or confirming authorization.
- Using one alert, score, or symptom as proof without context.
- Stopping after a technical change without verifying risk reduction or documenting the result.
Authorized practice
Use a private lab, synthetic data, or a paper exercise. Create a scenario involving Salts. List the asset, likely risk, existing control, evidence you would collect, the safest defensive action, and how you would verify success. Do not scan, test, access, or modify systems you do not own or have explicit permission to assess.
29.5 Digital Signatures
Digital Signatures protects information or proves integrity using mathematical techniques. A beginner should focus on the purpose of each technique, where keys or secrets live, and what can go wrong if those secrets are exposed.
Beginner picture: Encryption is like locking a box, hashing is like creating a tamper-evident fingerprint, and a digital signature is like attaching a verifiable seal.
Defensive example
A security team is reviewing Digital Signatures. Instead of assuming a problem, it first identifies the asset, expected behavior, available evidence, business impact, and the lowest-risk authorized action. This keeps the investigation evidence-based and defensible.
Safe security workflow
- Define the asset, user, service, or data connected to Digital Signatures.
- Write the expected normal behavior before deciding that something is suspicious.
- Collect evidence using read-only or low-risk checks whenever possible.
- Choose a defensive action that is authorized, reversible, and proportional to the risk.
- Verify the result, document the change, and escalate when the situation exceeds your role.
Common mistakes
- Treating Digital Signatures as a tool-only problem instead of considering people, process, and business impact.
- Making changes before preserving useful evidence or confirming authorization.
- Using one alert, score, or symptom as proof without context.
- Stopping after a technical change without verifying risk reduction or documenting the result.
Authorized practice
Use a private lab, synthetic data, or a paper exercise. Create a scenario involving Digital Signatures. List the asset, likely risk, existing control, evidence you would collect, the safest defensive action, and how you would verify success. Do not scan, test, access, or modify systems you do not own or have explicit permission to assess.
29.6 Signed Software
Signed Software extends security into modern applications and hosted environments. The same core ideas still apply—identity, least privilege, secure configuration, logging, data protection, change control, and clear responsibility.
Beginner picture: Moving a service to a new environment changes the building, not the need for locks, inventory, monitoring, safe construction, and emergency plans.
Defensive example
A security team is reviewing Signed Software. Instead of assuming a problem, it first identifies the asset, expected behavior, available evidence, business impact, and the lowest-risk authorized action. This keeps the investigation evidence-based and defensible.
Safe security workflow
- Define the asset, user, service, or data connected to Signed Software.
- Write the expected normal behavior before deciding that something is suspicious.
- Collect evidence using read-only or low-risk checks whenever possible.
- Choose a defensive action that is authorized, reversible, and proportional to the risk.
- Verify the result, document the change, and escalate when the situation exceeds your role.
Common mistakes
- Treating Signed Software as a tool-only problem instead of considering people, process, and business impact.
- Making changes before preserving useful evidence or confirming authorization.
- Using one alert, score, or symptom as proof without context.
- Stopping after a technical change without verifying risk reduction or documenting the result.
Authorized practice
Use a private lab, synthetic data, or a paper exercise. Create a scenario involving Signed Software. List the asset, likely risk, existing control, evidence you would collect, the safest defensive action, and how you would verify success. Do not scan, test, access, or modify systems you do not own or have explicit permission to assess.
29.7 File Verification
File Verification is an important part of Hashing, Integrity, and Signatures. For a beginner, learn four things first: what it protects, what could go wrong, what evidence shows a problem, and what safe defensive action reduces the risk.
Beginner picture: Cybersecurity becomes manageable when a large problem is broken into assets, threats, protections, evidence, and recovery steps.
Defensive example
A security team is reviewing File Verification. Instead of assuming a problem, it first identifies the asset, expected behavior, available evidence, business impact, and the lowest-risk authorized action. This keeps the investigation evidence-based and defensible.
Safe security workflow
- Define the asset, user, service, or data connected to File Verification.
- Write the expected normal behavior before deciding that something is suspicious.
- Collect evidence using read-only or low-risk checks whenever possible.
- Choose a defensive action that is authorized, reversible, and proportional to the risk.
- Verify the result, document the change, and escalate when the situation exceeds your role.
Common mistakes
- Treating File Verification as a tool-only problem instead of considering people, process, and business impact.
- Making changes before preserving useful evidence or confirming authorization.
- Using one alert, score, or symptom as proof without context.
- Stopping after a technical change without verifying risk reduction or documenting the result.
Authorized practice
Use a private lab, synthetic data, or a paper exercise. Create a scenario involving File Verification. List the asset, likely risk, existing control, evidence you would collect, the safest defensive action, and how you would verify success. Do not scan, test, access, or modify systems you do not own or have explicit permission to assess.
29.8 Integrity Monitoring
Integrity Monitoring turns technical activity into evidence that analysts can review. Effective monitoring begins with reliable timestamps, useful context, a normal baseline, and an escalation process rather than simply collecting more alerts.
Beginner picture: Security monitoring is like a smoke detector system: the value is not the noise itself, but detecting meaningful change early and sending the right people useful information.
Defensive example
A security team is reviewing Integrity Monitoring. Instead of assuming a problem, it first identifies the asset, expected behavior, available evidence, business impact, and the lowest-risk authorized action. This keeps the investigation evidence-based and defensible.
Safe security workflow
- Define the asset, user, service, or data connected to Integrity Monitoring.
- Write the expected normal behavior before deciding that something is suspicious.
- Collect evidence using read-only or low-risk checks whenever possible.
- Choose a defensive action that is authorized, reversible, and proportional to the risk.
- Verify the result, document the change, and escalate when the situation exceeds your role.
Common mistakes
- Treating Integrity Monitoring as a tool-only problem instead of considering people, process, and business impact.
- Making changes before preserving useful evidence or confirming authorization.
- Using one alert, score, or symptom as proof without context.
- Stopping after a technical change without verifying risk reduction or documenting the result.
Authorized practice
Use a private lab, synthetic data, or a paper exercise. Create a scenario involving Integrity Monitoring. List the asset, likely risk, existing control, evidence you would collect, the safest defensive action, and how you would verify success. Do not scan, test, access, or modify systems you do not own or have explicit permission to assess.
File integrity demonstration
This example is for your own lab or authorized environment. It is intentionally defensive and non-destructive.
# Create a harmless text file in your lab, calculate its hash,
# edit the file, then calculate the hash again and compare the values.Chapter practice lab
Create a one-page defensive worksheet for Hashing, Integrity, and Signatures. Include the asset, threat or failure scenario, likely impact, current protection, evidence sources, authorized defensive action, verification, and documentation.
15 Review Questions & Answers
1. What is the purpose of Hash Functions?
It helps protect assets, reduce risk, provide evidence, or support safe recovery depending on where it fits in the security lifecycle.
2. Why does Integrity Checks matter to a beginner?
Because it connects a security concept to a practical decision: what to protect, what to watch, what to change, and how to verify the result.
3. What should happen before changing Password Hashing Concepts?
Confirm authorization, identify the asset and risk, protect evidence, and choose the lowest-risk defensive action.
4. What is a common mistake with Salts?
A common mistake is acting on one symptom without context or making several changes before recording evidence.
5. How do you verify work involving Digital Signatures?
Repeat the relevant test, compare with expected behavior, check for unintended effects, and document the outcome.
6. What is the purpose of Signed Software?
It helps protect assets, reduce risk, provide evidence, or support safe recovery depending on where it fits in the security lifecycle.
7. Why does File Verification matter to a beginner?
Because it connects a security concept to a practical decision: what to protect, what to watch, what to change, and how to verify the result.
8. What should happen before changing Integrity Monitoring?
Confirm authorization, identify the asset and risk, protect evidence, and choose the lowest-risk defensive action.
9. What is a common mistake with Hash Functions?
A common mistake is acting on one symptom without context or making several changes before recording evidence.
10. How do you verify work involving Integrity Checks?
Repeat the relevant test, compare with expected behavior, check for unintended effects, and document the outcome.
11. What is the purpose of Password Hashing Concepts?
It helps protect assets, reduce risk, provide evidence, or support safe recovery depending on where it fits in the security lifecycle.
12. Why does Salts matter to a beginner?
Because it connects a security concept to a practical decision: what to protect, what to watch, what to change, and how to verify the result.
13. What should happen before changing Digital Signatures?
Confirm authorization, identify the asset and risk, protect evidence, and choose the lowest-risk defensive action.
14. What is a common mistake with Signed Software?
A common mistake is acting on one symptom without context or making several changes before recording evidence.
15. How do you verify work involving File Verification?
Repeat the relevant test, compare with expected behavior, check for unintended effects, and document the outcome.