1. Fundamentals of Cyber Security

Learning Objectives

• Define cyber security and explain the CIA triad (confidentiality, integrity, availability)
• Distinguish common threat categories: malware, phishing, DoS/DDoS, APTs, and social engineering
• Classify attacks as network-based, application-based, physical, or data-based
• Describe how frameworks like NIST CSF, ISO/IEC 27001, and MITRE ATT&CK guide security practice
• Explain the purpose of core defensive tools: firewalls, IDPS, antivirus, VPNs, and encryption
• Apply basic best practices to reduce an organization's attack surface

Quick Answer

Cyber security is the practice of protecting networks, devices, programs, and data from unauthorized access, damage, or disruption. It matters because almost every part of modern life — banking, healthcare, education, government — now runs on interconnected digital systems, and a single breach can expose millions of people's data or shut down critical infrastructure. At its core, cyber security rests on three goals known as the CIA triad: keeping information confidential (only the right people see it), intact (it isn't tampered with), and available (systems keep working when needed). Everything else — firewalls, encryption, authentication, frameworks — exists to serve one or more of these three goals.

What Is Cyber Security?

Cyber security is the set of technologies, processes, and practices designed to defend computers, networks, and data against attack, damage, or unauthorized access. It's not a single tool you install — it's a continuous discipline that combines technical controls (like firewalls and encryption) with human practices (like training staff to recognize phishing emails).

The CIA Triad

Every security decision traces back to three pillars:

• Confidentiality — only authorized people or systems can view the data. Encryption and access controls enforce this.
• Integrity — data can't be silently altered. Hashing and digital signatures detect tampering.
• Availability — systems and data are accessible when legitimate users need them. Redundancy and DDoS protection support this.

Real-world example: A hospital's patient database needs all three. Confidentiality keeps medical records private (violating HIPAA otherwise); integrity ensures a nurse doesn't accidentally (or maliciously) see the wrong dosage recorded; availability means the system must stay online during an emergency, because a security fix that locks doctors out is arguably worse than no fix at all.

Common misunderstanding: Students often think cyber security is only about "stopping hackers from breaking in" — that's confidentiality alone. A ransomware attack that encrypts a hospital's files without stealing anything is still a massive security failure because it destroys availability.

A Brief History

Cyber security concerns emerged alongside networked computing itself, but they became urgent after the 1980s, when personal computers proliferated and started connecting to shared networks. Early incidents like the Brain virus (1986, one of the first PC viruses) and the Morris worm (1988, one of the first self-replicating programs to spread across the early internet) showed that interconnected systems create shared risk — one infected machine can compromise thousands of others. This history matters because it explains why security is a network-wide concern, not just a per-machine one.

Types of Cyber Attacks

Attacks are usually grouped by where they target:

• Network-based attacks — Man-in-the-Middle (intercepting communication between two parties), replay attacks (resending captured legitimate data), and DNS spoofing (redirecting traffic to a fake destination).
• Application-based attacks — SQL injection (inserting malicious database commands through an input field), cross-site scripting or XSS (injecting scripts into web pages viewed by others), and buffer overflow (writing more data into memory than it was allocated for, corrupting adjacent memory).
• Physical attacks — shoulder surfing (watching someone type a password), tailgating (following an authorized person through a secure door), and insider threats (a trusted employee misusing access).
• Data-based attacks — data breaches (unauthorized exposure), exfiltration (secretly copying data out), and tampering (altering data without authorization).

Why it matters: Recognizing the category of an attack tells you where to focus defenses. A firewall stops many network-based attacks but does nothing against a tailgating insider — that requires physical access control and employee awareness training.

Cyber Security Frameworks

Organizations don't invent security practices from scratch — they follow established frameworks that codify what "good security" looks like.

• NIST Cybersecurity Framework — five continuous functions: Identify, Protect, Detect, Respond, Recover. It's a lifecycle, not a checklist: even a well-protected system needs a plan for detecting and recovering from the breach that eventually happens.
• ISO/IEC 27001 — an international standard for building an Information Security Management System (ISMS), focused on risk assessment and continual improvement.
• MITRE ATT&CK — a knowledge base cataloging real-world attacker tactics and techniques, used by defenders to understand how adversaries actually operate rather than theorizing about it.

Why it matters: Frameworks give organizations (and auditors, regulators, and insurers) a common language. A company claiming "we're secure" means little; a company that can show ISO 27001 certification demonstrates a verifiable process.

Cyber Security Tools and Technologies

• Firewalls — filter traffic between trusted and untrusted networks based on rules.
• Intrusion Detection and Prevention Systems (IDPS) — monitor traffic for suspicious patterns and can automatically block them.
• Antivirus software — scans for and removes known malware signatures on endpoints.
• VPNs — encrypt traffic over public networks, creating a private tunnel.
• Encryption — transforms readable data into unreadable ciphertext, protecting confidentiality even if data is intercepted or stolen.
• Secure protocols — HTTPS, SSH, and SFTP protect data in transit for browsing, remote access, and file transfer respectively.

Common misunderstanding: Many students believe antivirus software alone is "enough" security. In reality, antivirus only catches known malware signatures — it's one layer in a defense-in-depth strategy that also needs firewalls, patching, backups, and user awareness, because zero-day malware (never seen before) can slip past signature-based detection entirely.

Best Practices

1. Keep software and systems patched and updated.
2. Use strong, unique passwords for every account.
3. Enable multi-factor authentication (MFA) wherever possible.
4. Conduct regular security audits and penetration tests.
5. Train employees to recognize phishing and social engineering.
6. Encrypt sensitive data at rest and in transit.
7. Apply the principle of least privilege — give users only the access they need.
8. Back up data regularly and test restoring it.
9. Monitor systems and networks continuously for anomalies.
10. Stay informed about emerging threats and vulnerabilities.

Real-world example: The 2017 WannaCry ransomware outbreak exploited a Windows vulnerability that Microsoft had already patched months earlier. Organizations that followed best practice #1 (patch promptly) were unaffected; those that hadn't updated lost data across entire hospital networks. This single incident illustrates why "boring" practices like patching are often more effective than expensive security products.

Key Terms

Term	Definition	Related Concept
Confidentiality	Ensuring only authorized parties can access information	CIA Triad
Integrity	Ensuring data is accurate and unaltered	CIA Triad, Hashing
Availability	Ensuring systems and data are accessible when needed	CIA Triad, DDoS
Malware	Malicious software designed to damage or exploit systems	Virus, Trojan, Ransomware
Phishing	A social engineering attack that tricks users into revealing information	Social Engineering
DDoS	An attack that floods a system with traffic to make it unavailable	Availability
APT	Advanced Persistent Threat — a prolonged, targeted intrusion	Insider Threat
Firewall	A system that filters network traffic based on security rules	IDPS
Encryption	Converting readable data into unreadable ciphertext	Confidentiality
Least Privilege	Granting users only the access necessary for their role	Access Control

Common Mistakes

Misconception: Cyber security is mainly about preventing hackers from "breaking in." Why it's wrong: This view ignores availability and integrity. A DDoS attack or a ransomware encryption event doesn't require "breaking in" at all, yet it's a severe security failure. Correct understanding: Cyber security protects three equally important goals — confidentiality, integrity, and availability — and a real strategy defends all three.

---

Misconception: Installing antivirus software is sufficient protection. Why it's wrong: Antivirus relies heavily on known malware signatures and cannot catch zero-day exploits, insider threats, or social engineering attacks. Correct understanding: Security requires defense in depth — firewalls, patching, MFA, monitoring, and user training working together, not any single tool.

---

Misconception: Only large organizations or governments are worthwhile targets. Why it's wrong: Attackers frequently target small businesses and individuals precisely because they have weaker defenses, and automated attacks (like phishing campaigns or credential stuffing) don't discriminate by target size. Correct understanding: Every internet-connected system is a potential target, so baseline security practices apply regardless of organization size.

Comparison and Connections

Framework/Tool	Primary Focus	Best Suited For
NIST CSF	Lifecycle: Identify, Protect, Detect, Respond, Recover	Organizations building a security program from scratch
ISO/IEC 27001	Formal ISMS with certification	Organizations needing auditable compliance
MITRE ATT&CK	Cataloging real attacker behavior	Threat detection and red-team/blue-team exercises
Firewall	Filtering traffic at the network boundary	Blocking unauthorized network access
IDPS	Detecting/blocking suspicious traffic patterns	Catching attacks that bypass the firewall
Encryption	Protecting confidentiality of data	Data in transit and at rest

Practice Questions

Recall

1. What are the three components of the CIA triad? Look for: Confidentiality, Integrity, Availability.

2. Name two examples of early computer threats mentioned in the history of cyber security. Look for: Brain virus, Morris worm (or Trojan horses generally).

Understanding

3. Explain why a ransomware attack that encrypts files (without stealing any data) is still considered a serious security incident. Look for: it violates availability — legitimate users can no longer access their data or systems, even though confidentiality wasn't breached.

4. Why do organizations follow frameworks like NIST CSF instead of designing their own security process from scratch? Look for: frameworks provide a proven, common structure, make audits and compliance verifiable, and avoid gaps that an ad hoc approach might miss.

Application

5. A small business owner installs antivirus software and considers their network secure. Identify two gaps in this approach and suggest fixes. Look for: gaps such as no firewall/network monitoring, no MFA, no patching schedule, no employee training; fixes include adding these layers (defense in depth).

6. Classify each of the following as network-based, application-based, physical, or data-based: (a) SQL injection, (b) tailgating into a server room, (c) DNS spoofing, (d) copying a customer database without authorization. Look for: (a) application-based, (b) physical, (c) network-based, (d) data-based.

Analysis

7. Compare the NIST Cybersecurity Framework and ISO/IEC 27001 in terms of what each is designed to achieve. Look for: NIST CSF is a flexible lifecycle framework (Identify-Protect-Detect-Respond-Recover) focused on practical risk management; ISO 27001 is a formal, certifiable standard for building and auditing an Information Security Management System.

8. A company patches its systems immediately but has no employee security training. Analyze which categories of attack remain likely to succeed and why. Look for: social engineering and phishing attacks remain likely because they exploit human behavior, not software vulnerabilities that patching fixes; insider threats and physical attacks like tailgating are also unaddressed.

FAQ

Q: Is cyber security only relevant to computer science or IT careers? No. Anyone who uses email, online banking, or social media benefits from understanding basic cyber security — recognizing phishing, using strong passwords, and enabling MFA are life skills, not just professional ones.

Q: What's the difference between a virus, a worm, and a Trojan? A virus attaches itself to a legitimate file and needs a host action (like opening the file) to spread. A worm is self-replicating and can spread across a network without any user action, like the Morris worm. A Trojan disguises itself as legitimate software but carries a hidden malicious payload.

Q: Can a system ever be 100% secure? No. Security is about risk reduction, not risk elimination. Every added control also has a cost (money, usability, performance), so real security work is about identifying the most likely and most damaging threats and allocating defenses proportionally.

Q: Why do phishing attacks still work if everyone knows about them? Phishing exploits psychology, not technology — urgency, authority, and familiarity make people act before thinking. Attackers also constantly refine their tactics (like spear phishing tailored to a specific victim), so awareness training needs to be ongoing, not a one-time lecture.

Q: What career paths exist in cyber security? Common roles include penetration tester, incident responder, security analyst, digital forensics specialist, cloud security engineer, and eventually Chief Information Security Officer (CISO) — each focuses on a different stage of the identify-protect-detect-respond-recover lifecycle.

Quick Revision

• Cyber security protects the CIA triad: Confidentiality, Integrity, Availability.
• Ransomware primarily attacks availability; data breaches primarily attack confidentiality.
• Early threats: Brain virus (1986), Morris worm (1988) — showed networked systems share risk.
• Attacks fall into four categories: network-based, application-based, physical, data-based.
• NIST CSF: Identify, Protect, Detect, Respond, Recover — a continuous lifecycle, not a one-time checklist.
• ISO/IEC 27001 is a certifiable standard for an Information Security Management System.
• MITRE ATT&CK catalogs real-world attacker tactics and techniques.
• Firewalls filter traffic; IDPS detects/blocks suspicious patterns; antivirus catches known malware signatures.
• Encryption protects confidentiality; it does not by itself ensure availability or integrity.
• Defense in depth means layering multiple controls rather than relying on one tool.
• Patching promptly prevents many large-scale attacks (e.g., WannaCry exploited an already-patched vulnerability).
• Least privilege limits the damage any single compromised account can cause.

Related Topics

Prerequisites: Computer Networks basics, Operating Systems basics

Related Topics: Network Security Protocols, Cryptographic Algorithms and Protocols, Ethical Hacking and Penetration Testing

Next Topics: Network Security Protocols, Cryptographic Algorithms and Protocols