Cybersecurity Basics and Fundamentals

Cybersecurity is the practice of protecting computer systems, networks, applications, and data from unauthorized access, disruption, or damage. That single sentence is where cybersecurity basics start, and almost every other idea in the field hangs off it. It covers the technology used to protect those things, the processes that govern how they are used, and the people who operate both.

The scope is broader than most introductions suggest. Cybersecurity includes designing systems so they are hard to attack, verifying that the design held, watching for signs that somebody is attacking anyway, responding when they do, and proving to auditors and customers that all of the above is happening. Those are different disciplines that require different skills, and no one person does all of them.

The word most people mean when they say cybersecurity is usually one of those pieces. An engineer typically means secure design and configuration. A compliance officer typically means demonstrable control coverage. Somebody working an alert queue means detection and response. Being explicit about which part is under discussion prevents a lot of circular conversations.

Because nearly everything an organization does now runs on systems that can be reached remotely, and the same reachability that makes them useful makes them attackable, and the importance is not really about computers, it's about what the computers now hold, which is the money, the operations, the customer relationships, and the records.

Three specific consequences drive most of the investment:

• Operational disruption: ransomware and destructive attacks stop organizations from operating, sometimes for weeks. For hospitals, manufacturers, and logistics companies, downtime is the primary harm rather than data loss.
• Data loss and misuse: customer data, intellectual property, and credentials have resale value, and the loss of them creates regulatory, contractual, and reputational exposure that lasts far longer than the incident.
• Trust and obligation: enterprise customers, insurers, and regulators increasingly require demonstrable security as a condition of doing business, which means cybersecurity has become a commercial requirement and not only a risk-reduction one.

There is a fourth reason that is less often stated and matters just as much. Attacks are increasingly opportunistic and automated, which means an organization does not have to be a target to be attacked. Most incidents are not personal.

Cybersecurity works by layering four kinds of activity, and each one exists because the previous one is imperfect.

• Reduce the attack surface: remove what is not needed, patch what is, restrict who can reach what. Everything that follows is cheaper when there's less exposed.
• Prevent: put controls in the path of an attack so most attempts fail, such as multi-factor authentication, email filtering, endpoint protection, and network controls.
• Detect: assume some attempts will succeed, and collect enough telemetry to notice when one has. This is the point at which a security operations function becomes necessary.
• Respond and recover: have the ability to contain, remove, and restore, and practice it before you need it.

All four are needed because each layer has a known failure rate. Attack surface reduction cannot eliminate what the business genuinely needs to expose. Prevention fails against novel techniques and against credential theft, where the attacker arrives with valid access. Detection fails when the telemetry was not collected. Response fails when nobody has done it before.

Prevention is where you spend to reduce volume, and detection and response is where you spend to reduce impact, so a program that funds prevention alone has no way of knowing how often prevention failed, and a program that funds detection alone spends its whole budget watching problems it could have stopped. Programs that fund only one of the two are common.

The CIA triad is the model that describes the three properties security controls exist to protect: confidentiality, integrity, and availability.

• Confidentiality: only those authorized can see the information. Encryption, access control, and data classification serve this property.
• Integrity: the information is accurate and has not been altered without authorization. Hashing, digital signatures, change control, and audit logging serve this one.
• Availability: the information and the systems are usable when needed. Redundancy, backups, capacity planning, and denial-of-service protection serve this one.

The triad is useful because it forces a question that is otherwise easy to skip, which is what exactly a given control protects. It also makes the trade-offs visible, since strengthening one property often weakens another. Aggressive access controls protect confidentiality and can harm availability. Immutable backups protect integrity and availability and can complicate a deletion request.

Some frameworks, including ISO/IEC 27000 and NIST SP 800-53, extend the triad with additional properties such as authenticity and non-repudiation, those extensions are useful in specific contexts and the three original properties remain the frame that almost every control maps back to.

Availability threats announce themselves and confidentiality threats do not, which makes the triad one of the more useful severity heuristics an analyst has.

When an analyst triages an alert, the underlying question is which property is threatened and how badly. That maps to priority in a fairly consistent way:

• Availability threats usually surface fastest and get priority by default: because somebody notices. Ransomware, destructive activity, and denial of service are self-announcing, and the business escalates them without help from the SOC.
• Confidentiality threats are the ones that need the SOC most: because nothing breaks. Data staged for exfiltration, an unauthorized read of a sensitive share, or an account accessing records outside its normal pattern produce no user-visible symptom at all. If detection does not catch these, nothing else will.
• Integrity threats are the hardest to weigh and the most often underrated: A modified record, an altered configuration, or a tampered log has consequences that appear much later and are hard to unwind. Integrity attacks on logging deserve particular attention, since they degrade the ability to investigate everything else.

When two alerts have the same nominal severity, the one threatening a property that would otherwise go unnoticed generally deserves attention first, because the severity field was set by whoever wrote the detection and it knows nothing about which of the three properties is actually at risk in your environment on this asset today. Availability incidents will find you. Confidentiality incidents will not.

Information security is the protection of information in all forms. Cybersecurity is the protection of systems, networks, and data in digital form. Information security is the broader term, and cybersecurity sits inside it.

What differs is scope. A locked filing cabinet, a policy about discussing customer data in public, and a clean-desk rule are information security and are generally not cybersecurity. A misconfigured cloud storage bucket is both.

In everyday use, particularly in job titles and vendor marketing, the two are treated as synonyms and very little turns on the distinction. It becomes relevant in two places, in standards work, where ISO 27001 is deliberately an information security management standard covering paper and people as well as systems, and in regulated industries such as financial services, where obligations attach to information regardless of its form.

Cyber risk is the combination of how likely a harmful event is and how much harm it would cause. A threat is one of the inputs to that calculation, not the calculation itself.

The three terms that get conflated:

• A threat is something or someone that could cause harm. A ransomware group, an insider, a piece of malware, a natural disaster.
• A vulnerability is a weakness that a threat could use. An unpatched service, a weak password policy, an over-permissioned account, an employee who has never seen a phishing simulation.
• A risk is what you get when a threat can reach a vulnerability and the result would matter. Risk requires all three parts: a threat, a vulnerability, and an impact.

This is why a critical vulnerability on a system that holds nothing and is reachable by nobody may be a low risk, and why a moderate vulnerability on a system holding regulated data may be a high one, and vulnerability severity scores describe the weakness. Risk describes the consequence in your specific environment, which is something only you can assess.

Being pedantic about this matters because security programs are funded against risk and measured against vulnerabilities, and the gap between those two things is where a lot of misdirected spending happens.

Cyber resilience is the ability of an organization to keep operating, and to recover, while under attack or after a successful one, it accepts as a premise that some attacks will succeed, and shifts the question from whether you can be compromised to how much the compromise costs you.

In practice, resilience covers things that a purely preventive program tends to underinvest in:

• Recovery capability that has actually been tested: backups that nobody has restored from are a plan, not a capability — and the difference is usually discovered on the worst possible day.
• Backup isolation: backups reachable with the same credentials as production are commonly encrypted alongside it, so isolation and immutability matter more than backup frequency.
• Degraded-mode operation: knowing which business processes can run without which systems, and having a manual fallback for the critical ones.
• Decision-making under disruption: who decides to take systems offline, who talks to customers, and what happens when the usual communication channels are the compromised ones.

Resilience and security overlap heavily and they are funded by different arguments, which is why they often sit with different owners. Security investment is argued on likelihood reduction. Resilience investment is argued on impact reduction, and it is generally easier to justify after an incident than before one.