DSE ICT | Network Security and Encryption Lesson-Prep Guide (Tutor Edition)

DSE ICT | Network Security and Encryption Lesson-Prep Guide (Tutor Edition) | Symmetric, Asymmetric, Hashing, Phishing

2026-11-02

Tutor lesson-prep guides · Secondary ICT

Students know that HTTPS is safe, but cannot say which problem each cipher solves. This lesson separates confidentiality, integrity and authenticity with one two-key analogy, then settles the argument with bit counts.

Objectives — Students can: (1) separate confidentiality, integrity and availability, and name the technique that serves each; (2) explain symmetric encryption with one shared key against asymmetric encryption with a public and private pair, and say why HTTPS uses both; (3) justify key strength with bit counts, including why a 256-bit key is not 256 possible keys.

01 Prerequisites (3-minute check)

If any of these fails, fix it before the lesson starts.

Skill	Quick check	Pass mark
Data representation	How many bits are in one byte	Eight bits
Powers and logs	What is two to the tenth approximately	About 1024
Internet basics	What do a domain name and an IP address each do	The name is for humans and resolves via DNS to an IP that locates the host

02 Lesson flow (60 minutes)

Time	Stage	Tutor does	Student does
0-5 min	Opening probe	Write 64 on the board and ask what it might count in security	Answer aloud, one idea each
5-15 min	Prerequisite check	Hand out three quick questions, mark live	Written answers, self-marked
15-37 min	Three acts	Teach threats, symmetric against asymmetric, then hashing and certificates	After each act, name the goal it serves
37-49 min	Worked tasks	Model four tasks, each starting with goal, technique, limitation	Copy then rewrite from memory
49-55 min	Independent practice	Circulate and ask only: is this integrity or confidentiality	Three tasks, self-checked
55-60 min	Exit check	Collect papers and count errors on the spot	Written, no discussion

03 Teaching script (read it out)

Scene 1: Act one: threats and three lines of defence

Start with goals, or the vocabulary never sticks. Confidentiality means others cannot read the content, integrity means it was not altered, availability means the service keeps running. Match techniques: encryption for confidentiality, hashing and digital signatures for integrity, backups, firewalls and rate limiting for availability. Then name concrete attacks: phishing mail that harvests passwords, man-in-the-middle interception on open Wi-Fi, ransomware encrypting files, denial of service flooding a server, and credential stuffing with leaked passwords. Put a number on scale: 1000 phishing messages at a 5 percent click rate means 50 victims, and at a 20 percent report rate only 10 complaints reach the security team. That figure is why reporting behaviour counts as much as any product.

Can a firewall stop a phishing email? Be precise about what it filters.

Scene 2: Act two: symmetric and asymmetric

Symmetric encryption uses one key for both directions, as in AES. A 256-bit key gives two to the power 256 combinations; at a trillion attempts per second, with about 3.15 times ten to the seventh seconds in a year, a full search would run for 3.7e+57 years. Do not memorise that number, but do state the rule: each extra bit doubles the work. Asymmetric encryption uses a pair, with the public key encrypting and the private key decrypting, as in RSA. It solves the problem symmetric encryption cannot solve alone, namely delivering the shared key. It is also slow, so HTTPS runs hybrid: the handshake uses asymmetric cryptography to agree a short session key, and the bulk traffic then uses symmetric encryption. Any answer must explain why both are used, not merely that both appear.

What goes wrong if a system uses only asymmetric encryption?

Scene 3: Act three: hashing, signatures and certificates

A hash is not a cipher. It is one way, fixed length, and always the same output for the same input. SHA-256 produces 256 bits, which is 64 hexadecimal characters at four bits each. Three uses follow: store password hashes rather than plaintext, compare file hashes to confirm a download, and sign data with a private key. Get the signature direction right: the sender signs with the private key and the receiver verifies with the public key, so what is proved is origin plus integrity, never secrecy. A certificate is a statement signed by a trusted authority saying this public key belongs to this domain. Measure password strength in entropy: with a 94 character alphabet, eight characters give about 52.4 bits, twelve give 78.7, sixteen give 104.9. Length buys far more than adding one symbol.

Why should a website never store the passwords users type?

04 Question types and worked steps

Type	Example	Steps	Answer
Concept distinction	Separate encryption from hashing.	Reversibility, key requirement, output length, one use each, then a closing sentence.	Example: encryption hides, hashing verifies.
Key-space calculation	How much harder is a 256-bit key than a 128-bit key?	Each bit doubles the work, the gap is 128 bits, so the factor is two to the 128, described as astronomical.	Example: a factor of two to the 128.
Process account	Describe how an HTTPS session is established.	Request the certificate, verify the chain, exchange a session key with the public key, then switch to symmetric traffic.	Example: asymmetric to open, symmetric to run.
Applied scenario	An email claims to be from a bank and asks for a password reset. Give three correct actions.	Do not click, navigate to the official site directly, report to the bank or IT team, plus one reason for each.	Example: reporting protects others too.

Sanity check (teach this): Check the conversions before class: 256 bits divided by four gives 64 hexadecimal characters, so an answer of 32 has used bytes instead of bits. A 256-bit key means two to the 256, not 256 keys. Entropy of 52.4 against 78.7 bits comes from characters times log base two of 94, so twelve characters are not four bits stronger. Phishing works out as 1000 times 0.05 equals 50, then times the report rate equals 10; all three steps must appear. A signature proves origin and integrity, never confidentiality, and that is the most frequent misstatement.

05 Independent practice (3 questions)

Question	Answer	What to watch
Give one strength and one weakness of each encryption type.	Symmetric is fast but key delivery is hard; asymmetric solves delivery but is slow.	Watch for speed being listed as a weakness of asymmetric only by accident.
Why does HTTPS use both types?	Asymmetric safely agrees a session key, symmetric then carries the traffic at speed.	Watch for answers that stop at the word safer.
How should a site store user passwords?	Store a salted one-way hash, never plaintext and never reversible encryption.	Watch for encrypt-then-decrypt answers.

06 Common mistakes and what to say

Mistake	Student writes	Say this
Confusing hashing with encryption	Saying the site decrypts the SHA-256 hash to check the password.	A hash cannot be reversed. The site hashes the typed password and compares the two digests.
Assuming asymmetric is always stronger	Claiming RSA beats AES so everything should use RSA.	Strength depends on key size and implementation, not on category, and RSA is far slower.
Reading a signature as secrecy	Saying a digital signature stops anyone reading the message.	A signature proves who sent it and that it is unchanged; the body stays readable unless separately encrypted.
Mixing bits and bytes	Answering that SHA-256 outputs 32 characters.	256 bits over four gives 64 hex characters; 32 is the byte count. State the unit every time.

07 Homework (paper, section and question numbers)

Secondary ICT chapter index: finish the three tasks here, then revisit bit and byte conversion in the data representation chapter — Tasks 1-3 on this page

08 Exit check (last 5 minutes)

Question	Answer	Decision
How many keys does symmetric encryption use?	One, shared by both sides	Wrong means reteach act two
How many hex characters does SHA-256 output?	64	Wrong means reteach act three
Why does HTTPS combine both cipher types?	Asymmetric agrees the key, symmetric carries the data fast	Wrong means reteach act two

09 Tutor FAQ

Which year group is this for?

Mainly S4 networking and security units; S5 revision can pair it with data representation for bit conversions.

Do students need the RSA mathematics?

No. They need the public and private key roles and the idea that longer keys are harder to break.

Is hashing examined alongside encryption?

Usually as a comparison, so prepare the three column table: reversibility, length, purpose.

Find a tutor — free Tutor Registration →

A TutorZone lesson-prep guide. Written by the TutorZone team; questions and lesson flow are original and are not taken from any school or publisher material.