What cybersecurity is
Cybersecurity is protecting an organisation's systems, data and people from harm. Meet the words every defender uses (assets, the CIA triad, threats, vulnerabilities, risk and controls), then watch a common real attack, a phishing email that leads to a stolen password, get stopped layer by layer by an email filter, trained staff, MFA, patching and backups. Finish with the six functions of the NIST Cybersecurity Framework 2.0.
5 quick questions
Pick an answer to see why. Your score saves with your progress.
01Customer records are changed by someone who should not be able to change them. Which part of the CIA triad is harmed?
Integrity means data is only changed by people allowed to change it. Confidentiality is about who can read it; availability is about it working when needed.
02A server runs old software with a known flaw that has not been patched. That unpatched flaw is an example of what?
A vulnerability is a weakness a threat could use. The threat is whoever might use it, such as a criminal; the server is the asset; installing the update (patching) is the control.
03An attacker has stolen a staff member's password through a fake sign-in page. Which control stops them signing in?
MFA asks for a second proof, such as a code or a security key the real user has. A password alone is not enough to sign in.
04Why do defenders use several layers of controls (defence in depth)?
In the figure the filter missed one email and a person clicked, yet MFA, patching and backups still stopped the harm. Layers lower risk; they never make it zero.
05Restoring files from a tested, offline backup after ransomware belongs to which NIST CSF 2.0 function?
Recover: assets and operations affected by an incident are restored. Making and testing the backups beforehand is part of Protect.
Glossary
- Cybersecurity and assets
- Cybersecurity is protecting an organisation's systems, data and people from harm, such as theft, damage or disruption. Assets are the things worth protecting: data, the computers and services that hold it, and the people who use them.
- CIA triad
- The three goals for data and systems: confidentiality (only the right people read it), integrity (only allowed changes) and availability (it works when needed).
- Threat, vulnerability, risk
- A threat is anything that could cause harm; a vulnerability is a weakness it could use; risk is how likely the harm is and how bad it would be.
- Control, patching, defence in depth
- A control is a safeguard that lowers risk, from people (training), process (routines such as patching: installing the maker's updates that fix known software flaws, and making backups) or technology (filters, MFA). Defence in depth stacks several different controls, so one failure is caught by the next layer.
- Phishing and account takeover
- Phishing is a fake message that tricks someone into clicking a link, opening a file or typing a password. With a stolen password an attacker may try an account takeover: signing in and acting as that person.
- Multi-factor authentication (MFA)
- Signing in with a second proof as well as the password, such as a code, an app tap or a security key. A stolen password alone is then not enough to sign in.
- Ransomware
- Harmful software that locks up (encrypts) an organisation's files and demands payment to unlock them. Tested, offline backups let the files be restored without paying.
- NIST CSF 2.0
- The NIST Cybersecurity Framework 2.0 (2024): a common way to organise security work into six functions: Govern, Identify, Protect, Detect, Respond and Recover.
Notes and sources
- Confidentiality, integrity and availability are the three security objectives defined in law and in FIPS 199. Many courses add more (such as authenticity and non-repudiation); the figure keeps the classic three.
- The attack is drawn as one tidy chain to show how layers work. Real incidents vary: attackers try many routes at once, and an organisation needs every layer at the same time, not one after another.
- MFA codes and push taps can still be tricked out of people by some fake pages. CISA recommends phishing-resistant MFA, such as FIDO security keys or passkeys, especially for email and other important accounts.
- "People, process and technology" is a common way to group controls, not a NIST term. NIST groups the same work into the six CSF functions shown at the front.
- NIST SP 800-30 calls risk a function of how likely an event is and how bad its impact would be. Writing it as likelihood × impact is a common simplification, not an exact formula.
- This course is about defence. It explains how attacks work only at the level needed to stop them, and never how to attack a real system.
- NIST CSWP 29: The NIST Cybersecurity Framework (CSF) 2.0 (February 26, 2024)
- NIST FIPS 199: Standards for Security Categorization of Federal Information and Information Systems
- NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments
- NIST CSRC Glossary: vulnerability
- NIST CSRC Glossary: defense-in-depth
- CISA Secure Our World: Recognize and Report Phishing
- CISA: Avoiding Social Engineering and Phishing Attacks
- CISA: More than a Password (multi-factor authentication)
- CISA: Known Exploited Vulnerabilities Catalog
- CISA and MS-ISAC: #StopRansomware Guide
Quiz Unlocks after the last step.