Tags: #◇Computer Science #◇NSSECU1 #◇Conceptual #◇Introduction to Cybersecurity
◇Overview
Cybersecurity is the practice of protecting systems, networks, and programs from digital attacks. These cyberattacks are usually aimed at accessing, changing, or destroying sensitive information, extorting money from users, or interrupting normal business processes. This module provides a foundational understanding of the cybersecurity landscape, the CIA Triad, risk management, and basic threat modeling.
◇Key Definitions
- Threat: Any circumstance or event with the potential to adversely impact organizational operations, assets, or individuals.
- Vulnerability: A weakness in an information system, system security procedures, internal controls, or implementation that could be exploited.
- Risk: A measure of the extent to which an entity is threatened by a potential circumstance or event.
- CIA Triad: The foundational model for information security, consisting of Confidentiality, Integrity, and Availability.
◇Theoretical Framework / Core Concepts
The CIA Triad
The CIA Triad is the core pillar of information security.
- Confidentiality: Ensuring that information is not disclosed to unauthorized individuals, entities, or processes (e.g., encryption, access controls).
- Integrity: Maintaining and assuring the accuracy and completeness of data over its entire lifecycle (e.g., hashing, digital signatures).
- Availability: Ensuring that authorized users have access to information and associated assets when required (e.g., DDoS mitigation, redundancy).
Risk Management Framework
Risk management involves identifying, assessing, and mitigating risks to an acceptable level.
- Risk Assessment: Identifying vulnerabilities and threats.
- Risk Mitigation: Implementing controls (preventative, detective, corrective).
- Risk Acceptance: Acknowledging the risk and choosing not to implement controls because the cost outweighs the benefit.
◇Worked Examples / Protocol Walkthroughs / Calculations
Threat Modeling Scenario
Consider a web application that stores user data.
- Identify the Asset: User database.
- Identify the Threat: SQL Injection attack by an external hacker.
- Identify the Vulnerability: Lack of input validation on the login form.
- Calculate Risk: Risk = Threat Vulnerability Impact. High likelihood High impact = Critical Risk.
- Mitigation: Implement parameterized queries (prepared statements).
◇Summary & Key Takeaways
- Cybersecurity aims to protect the confidentiality, integrity, and availability of information.
- Risk management is an ongoing process of identifying and mitigating threats.
- Threat modeling helps proactively secure systems by thinking from an attacker's perspective.
◇References & Navigation
- Next Topic: ◇OS Basics and Cryptography
- Related Notes: ◇Cybersecurity Awareness, ◇Security
ACTIVE RECALL VERIFICATION
Select an answer to verify conceptual comprehension and reveal the technical rationale.
Which of the following is NOT part of the CIA Triad?
What does Confidentiality ensure?
A weakness in a system that can be exploited is called a:
Which security control is designed to fix an issue after an incident has occurred?
What is the formula often used to conceptualize risk?
Hashing is primarily used to ensure which part of the CIA Triad?
Implementing a backup generator is an example of supporting which principle?
Threat modeling is best performed during which phase of software development?
Accepting a risk means:
Which of the following best describes an Insider Threat?