Securing applications and data
Protect applications and data
Distinguish encryption, hashing, access controls, and application security.
Work through defensive scenarios and explain the evidence behind each decision.
Use the right cryptographic tool
Symmetric encryption uses a shared secret key. Asymmetric cryptography uses a related public and private key pair. Encryption is reversible with the appropriate key; a cryptographic hash is designed as a one-way digest. A hash by itself does not hide a predictable value from guessing.
Protect the keys as well as the encrypted files. Backups support availability, but must also be access-controlled and tested by restoring data. Copying a corrupted database creates another corrupted copy rather than proving recovery.
Enforce rules at the application boundary
Validate expected input and use parameterized database operations so input is treated as data. Check authorization on the server for every protected operation; hiding a button is not an access-control check.
Use fictional audit records to identify repeated access denials, unusual exports, or unexpected configuration changes. Explain which records support the conclusion and which additional evidence would distinguish an attack from an authorized action.
Check yourself
Can encryption replace access control?Show answer
No. Someone with authorized decryption access can still misuse data. Decide who may access it and monitor sensitive actions.
References used to build these lessons
We used these official documents as references when building this course's lessons. They are the sources for the syllabus structure and course requirements.
College Board · Effective fall 2026