What is cybersecurity? What we protect, and from what
Lesson 1 of 6
1What is cybersecurity? What we protect, and from what
The big pictureThink of your home. You want three things: nobody reads your private letters, nobody tampers with your things, and you can get in whenever you like. Cybersecurity is the same for your accounts, your phone and company data. And most breaches do not start with a genius picking locks, but with someone who opened the door because they believed a fake message.
What the picture shows: Many attacks head for the company, and each layer of protection stops some of them. No single layer is perfect, but together they hold: that is "defence in depth".
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
Your home has valuable things (assets). There are burglars in the area (the threat). The kitchen window does not lock (the vulnerability). The chance a burglar gets in through that window and takes something valuable is the risk. Locks, cameras and a watchful neighbour are controls. No home is burglar-proof, but a home can be not worth the burglar's effort.
Risk is a function of the likelihood that a threat exploits a vulnerability and the impact on the asset. The goals are three: confidentiality, integrity, availability (CIA). Controls are classed by nature (technical, administrative, physical) and by function (preventive, detective, corrective, deterrent, compensating). AAA: authentication, authorisation, accounting. The guiding principles: defence in depth, least privilege, separation of duties, and failing safe.
Before You Start
🌍How the internet works (stage 0)
Enough to know your device talks to servers over the network.
🛰️Darb's networking path
Not needed for this lesson, but it underpins the lessons on attackers, systems security and detection.
The Core Idea
1Asset, threat, vulnerability, risk
Four words you will hear every day. An asset is anything of value: customer data, a server, a bank account, the company's reputation. A threat is who or what could do harm: a ransomware gang, an angry employee, a flood. A vulnerability is a weak spot that can be used: an unpatched system, a reused password. An exploit is the actual way the weakness is used.
Risk puts them together: the likelihood that a threat exploits a weakness, times the impact. There is no perfect security; the goal is to lower the risk to a level management accepts and writes down.
Rank the risks yourself: change a likelihood or impact and run. You will meet this again in part ten.
# a tiny risk score: likelihood and impact from 1 (low) to 3 (high)
risks = [
("Unpatched VPN gateway", 3, 3),
("Reused staff passwords", 3, 2),
("Server room door left open", 1, 2),
]
for name, likelihood, impact in sorted(risks, key=lambda r: r[1] * r[2], reverse=True):
score = likelihood * impact
level = "high" if score >= 6 else "medium" if score >= 3 else "low"
print(f"{score} {level:6} {name}")2The CIA triad
Every security measure protects one or more of three goals. Confidentiality: only those allowed can read it. Integrity: nobody changes it without permission. Availability: it is there when you need it. Whenever you read about an attack, ask: which side did it break?
The CIA triad: what exactly do we protect?
Press any side to see what it means, an attack that breaks it, and the controls that protect it.
C · Confidentiality
- Meaning
- Only those allowed can see the information.
- An attack that breaks it
- A leaked customer database, eavesdropping on open Wi-Fi, or a stolen password.
- Controls that protect it
- Encryption in transit and at rest, access control, multi-factor sign-in, and data classification.
I · Integrity
- Meaning
- The information is correct and nobody changed it without permission.
- An attack that breaks it
- Changing the amount of a transfer on its way, or tampering with an update before you download it.
- Controls that protect it
- Hashes (fingerprints), digital signatures, change control, and logs nobody can edit.
A · Availability
- Meaning
- The system and the information are there when you need them.
- An attack that breaks it
- A denial-of-service attack, ransomware encrypting the servers, or a power cut with no backup.
- Controls that protect it
- Backups, redundancy, flood (DDoS) protection, and a business continuity plan.
Balance matters: tightening confidentiality without limit can hurt availability, like a system so secure nobody can use it.
3Controls: technical, administrative, physical
A control is anything that lowers risk. By nature it is technical (firewall, encryption), administrative (policy, training, background checks) or physical (lock, badge, camera). By function it is preventive (stops it before), detective (alerts you during) or corrective (restores you after).
| Function | Technical | Administrative | Physical |
|---|---|---|---|
| Preventive | MFA | Password policy | Server room lock |
| Detective | SIEM alerts | Periodic access review | CCTV |
| Corrective | Restore from backup | Incident response plan | Backup generator |
AAA is three questions every system asks: authentication, who are you? Authorisation, what may you do? Accounting, what did you do? Logs are what answer the third question after any incident.
4Defence in depth and least privilege
Defence in depth means different layers of controls, so when one fails another stops the attacker, as in the opening drawing. Least privilege means every person and program gets only the minimum it needs, so a stolen account does limited damage.
Worked example
The task: classify: a web server not updated for a year, and an active ransomware group targeting your sector. Which is the vulnerability, which the threat, and what is the risk?
The answer: the unpatched server is the vulnerability and the active group is the threat. The risk is the likelihood the group exploits that flaw times the impact: downtime, leaked data, fines. Since exploiting flaws became the top way in according to Verizon's 2026 report, the risk is high and the priority is to patch or isolate the server now.
Myth vs Reality
| Myth | Reality |
|---|---|
| I am not important, nobody will target me. | Most attacks are automated and wide; your account and device are worth something for sending scams or launching other attacks. |
| I have antivirus, so I am safe. | It is one layer. Phishing, stolen passwords and unpatched flaws go around it. |
| Cybersecurity means hacking. | Offensive testing is a small part. Most of the work is defensive: monitoring, response, governance, cloud and application security. |
Where you meet it at work
🏠At home
You ask: what are my key assets? My email, bank and photos. Then put a control on each.
🧑💻Developer
Every new feature is a new asset with new possible flaws; think about them before the code.
🏢Manager
Decides which risks to accept and which to treat, and signs for it.
Test your understanding
A DDoS attack mainly targets:
Its aim is to take the service away from legitimate users, which hits availability.
A server not updated for a year is:
It is a weak spot. The threat is whoever might use it.
A camera in the server room is a control that is:
It is a physical thing on site, and it reveals what happens rather than stopping it.
A lock on the server room door is which kind of control?
Controls come in three kinds: technical like a password, administrative like a policy, physical like a lock.
An employee can see every salary though the job does not need it. Which principle is broken?
Everyone gets only what their work needs.
Quick review cards
Check Your Understanding
Why is there no "perfect security"?
Because threats and flaws keep changing and every control has a cost; the goal is acceptable risk, not zero risk.
An employee changes an invoice amount without permission. Which side of CIA broke?
Integrity, because the information was changed without permission.
Name one preventive and one detective control for your email account.
Preventive: MFA. Detective: an alert on sign-in from a new device.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
course2
Done with this lesson?
Sign in to save your progress.