Cybersecurity Fundamentals

Almost every security decision traces back to three goals, known as the CIA triad:

• Confidentiality — only authorized people can see the data
• Integrity — data can't be altered without detection
• Availability — authorized people can access it when they need to

These goals genuinely conflict sometimes. Extreme confidentiality (locking everything down) can hurt availability. Security work is often about finding the right balance for a specific risk, not applying maximum restriction everywhere. "Secure" isn't a fixed state — it's a tradeoff decision made deliberately, based on what you're actually protecting and from whom.

Most real-world incidents fall into a small number of categories:

• Phishing — deceptive messages designed to steal credentials or deliver malware. The single most common entry point for real breaches.
• Malware — malicious software: viruses, trojans, spyware — designed to damage, steal, or gain unauthorized access.
• Ransomware — malware that encrypts data and demands payment; among the most disruptive attack types organizations face today.
• Social engineering — manipulating people rather than systems; phishing is one form, but it also includes phone-based pretexting and physical tailgating.
• Insider threats — harm from someone with legitimate access, whether malicious or simply careless.

Notice the pattern: most of these exploit human trust more than they exploit technical flaws. That's exactly why awareness training matters as much as technical controls.

Authentication proves who you are; authorization decides what you're allowed to do once you're in. Getting both right is foundational.

• Passwords remain the most common factor, and the weakest on their own — length matters more than complexity for resisting brute-force attacks.
• MFA (multi-factor authentication) adds a second, independent factor (a code, a key, a biometric) — it stops the overwhelming majority of credential-based attacks even when a password is compromised.
• Least privilege means giving people exactly the access they need, no more — so a single compromised account causes the smallest possible amount of damage.

With more work happening outside a traditional office network, identity has effectively become the new security perimeter — who you are matters more than where you're connecting from.

No single control stops every attack, so security is built in layers — if one fails, others are still standing behind it. A typical layered model:

• Physical — locked server rooms, badge access
• Network — firewalls, segmentation, VPNs
• Endpoint — antivirus/EDR on individual devices
• Identity — MFA, least privilege, conditional access
• Data — encryption, backups, access logging

When evaluating a security posture, ask what happens if any one layer fails — a mature environment has an answer for that, not just a single point of protection.

Real phishing red flags to train yourself to notice:

• Urgent or threatening language demanding immediate action
• A sender address that looks almost right, but not quite (a lookalike domain)
• Links whose actual destination (visible on hover) doesn't match the text or context
• Requests for credentials, gift cards, or wire transfers — especially from an "executive" out of the blue

The correct response is never to click "just to check." Report it through your organization's official channel, and if credentials were already entered, treat it as an active incident — reset the password and check sign-in logs immediately, not eventually. The Knowledge Base has a full walkthrough of this exact process.

A CVE (Common Vulnerabilities and Exposures) is a publicly cataloged, known security flaw in software. Once a CVE is public, attackers actively look for systems that haven't patched it yet — the window between disclosure and patching is genuinely dangerous.

Vulnerability scanning tools check systems against known CVE databases and flag what's out of date. Patch management is the discipline of actually applying fixes promptly and systematically, not just knowing they exist. In practice, this is one of the highest-leverage, least glamorous parts of security — most real breaches exploit vulnerabilities that had a patch available for months.

When something does go wrong, response generally follows six phases:

1. Preparation — having a plan, tools, and contacts ready before you need them
2. Identification — confirming an incident is actually happening, and what it is
3. Containment — limiting the damage, often by isolating affected systems
4. Eradication — removing the actual cause (malware, unauthorized access, the vulnerability itself)
5. Recovery — safely restoring normal operation
6. Lessons learned — documenting what happened and what changes to prevent a repeat

Documentation matters here just as much as it does on a routine help desk ticket — arguably more, since incident writeups often have legal and compliance weight beyond internal use.