Security

Secrets, identity, and trusted context

A secret sometimes authenticates access; a lesson must not collect it or confuse it with complete authorization.

Back to track

Objectives

Classify sensitive data.
Check identity and context without exposing a secret.

Duration: 9 min
Level: Foundational

Prerequisites

Authorization and fail-closed

Concepts

Secret
A value that must remain confidential, such as a private key, password, or short-lived session credential.
Identity and authority
Knowing who or what acts is not enough to establish what that identity may do.
Trusted context
Origin, domain, version, channel, and scope should be checked against independent reference points.
Destination and artificial urgency
The actual destination must be checked against an independent source; artificial urgency changes neither policy nor the stopping condition.

Visual guide

Before sharing or acting

Identify the data.
Check domain, destination, version, and channel.
Compare identity and scope.
Ignore urgency pressure.
Stop when there is ambiguity.

Synthetic example

A learning page asks for a private key to continue. The correct response is to enter nothing and leave the flow.

An educational resource needs no secret.

Lesson scope

This lesson provides categories and a stop reflex for a sensitive request.

What this lesson does not demonstrate

It does not confirm that a real domain, device, identity, or channel is safe.

Check question

Which check remains necessary after recognising an identity?

None: a known identity has all authority.

Check only the interface name and colour.

Check the scope, channel, version, and context of the action.

Choose an answer to read its feedback.

Guided local activity

Classify what must not be entered

Select every item that must remain outside an educational activity.

Enter no personal or sensitive data; only these local options are used.

Local checklist

Independent channel

Write a fictional verification procedure.

Do not test any real account, domain, or identifier.

Sources and limitations

Source repository: https://github.com/SwissTokint/swisstokint-website
Source reference: codex/learning-hub-v3-autonomous-controls
Content commit: 29c88f79cee07a72804bc017b92fab9200fd3734
Source version: learning-v3

Zero Trust ArchitectureNIST-SP800-207
Publisher
National Institute of Standards and Technology (NIST)
Version or date
Final, 2020-08
Link verified on
2026-08-13
Scope used
Explicit decisions, context, and resource-centred protection.
Limitation
A general architecture, not implementation validation.
Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design SoftwareCISA-SBD-2023
Publisher
CISA and international partners
Version or date
Updated 2023-10
Link verified on
2026-08-13
Scope used
Secure-by-default values and producer accountability.
Limitation
A guide to principles, not certification.