Learn
Cybersecurity Fundamentals
The core language of protection: goals, identity, cryptography, and the difference between a threat, a vulnerability, and a risk.
- Use confidentiality, integrity, and availability precisely
- Separate encryption from hashing and authentication from authorization
- Describe risk without treating every flaw as an incident
Confidentiality keeps information from the wrong parties. Integrity shows whether it changed. Availability keeps it usable when people need it.
Goals
- Availability
Keeping systems and information usable when authorized people need them.
- CIA Triad
The three goals of privacy, trustworthiness, and timely access.
- Confidentiality
Keeping information from parties who are not allowed to see it.
- Integrity
Keeping data and systems free from unauthorized changes.
- Non-repudiation
Evidence that makes it hard for someone to deny what they did.
Identity
- AAA
The framework that separates identity proof, permission, and audit records.
- Accounting
Recording who did what, and when, for later review.
- Authentication
Proving that a claimed identity is genuine.
- Authorization
Deciding what an accepted identity is allowed to do.
- Multi-Factor Authentication
A login that requires two different kinds of evidence.
Cryptography
- Asymmetric Encryption
Cryptography that uses a public key and a related private key.
- Digital Certificate
A signed document that binds an identity to a public key.
- Digital Signature
A private-key value that lets others verify the signer and detect changes.
- Encryption
Transforming data so only someone with the proper key can read it.
- Hashing
A one-way fingerprint of data that cannot be reversed into the original.
- Password Salt
A unique random value stored with a password hash to make guessing harder.
- PKI
The system for issuing, distributing, and revoking public-key certificates.
- Symmetric Encryption
Encryption where the same secret key locks and unlocks the data.
Risk
- Exploit
A method that uses a weakness to cause an unintended effect.
- Risk
The potential for loss, based on likelihood and impact.
- Threat
A potential cause of an unwanted incident that could cause harm.
- Threat Actor
A person, group, or automation that may cause a security event.
- Vulnerability
A weakness that could be used to cause harm.
Design
- Attack Surface
Every point where an unauthorized person could try to get in or take data.
- Defense in Depth
Several independent layers so one failure does not expose everything.
- Least Privilege
Granting only the access a task actually needs.
- Security Control
A safeguard that prevents, detects, or corrects a security problem.
- Zero Trust
A design that verifies every access instead of trusting a network location.
Threats
- Malware
Software built to do unwanted or harmful things on a system.
- Ransomware
Malicious software that locks data and pressures the victim to pay.