What we protect
Cybersecurity is protecting an organisation's systems, data and people from harm. The things worth protecting are its assets. Here: a staff member and their laptop, a server holding customer records, and a backup copy of that data.
For data we want three things, called the CIA triad. Confidentiality: only the right people can read it. Integrity: nobody changes it without permission. Availability: it works when people need it. An attack harms at least one.
A threat is anything that could cause harm, like a criminal emailing fakes to staff. A vulnerability is a weakness it could use: a password as the only lock, or old software on the server. Risk is how likely harm is, and how bad.
Controls are safeguards that lower risk. They come from people (staff trained to spot fakes), process (routines such as installing updates and making backups) and technology (an email filter, a second sign-in check). Each control is a layer.
An attack, layer by layer
A common attack starts with phishing: a fake email, here pretending to be the IT team, asking you to sign in on a fake page. The email filter, the first layer, blocks many fakes. This one slips through.
The next layer is people. Trained staff check the sender and the link, and report fakes instead of clicking. But today someone is in a rush: they click and type their password into the fake page. It goes to the attacker.
The attacker tries to sign in with the stolen password: an account takeover. Multi-factor authentication (MFA) also asks for a second proof, like a code or a security key the real user has. The attacker has neither, so it fails.
Attackers also try known flaws in software. Patching means installing the maker's fixes, which closes those flaws. CISA keeps a public list of flaws used in real attacks, so defenders can fix those first. This server is up to date.
Suppose something still gets in: ransomware, which scrambles files and demands payment. Backups restore them. CISA advises keeping offline copies an attacker cannot reach, and testing that restoring really works. Availability comes back.
No layer is perfect: the filter missed an email and a person clicked. Defence in depth means stacking different layers, so the next one catches what the last one missed. One mistake should never be enough to cause harm.
The NIST framework
NIST's Cybersecurity Framework 2.0 sorts this work into six functions. Govern: set the strategy, roles and rules. Identify: know your assets and risks. Protect: use safeguards, like training, MFA, patching and backups.
Detect: notice attacks, like an alert for a strange sign-in. Respond: act on an incident, contain it and tell the right people. Recover: restore systems and data, for example from backups. Govern runs underneath all five.
What happens
;; step 1/12 · assets cybersecurity protecting systems, data and people from harm assets what is worth protecting laptop a staff member and the computer they use server the customer records (the data) backup a second copy of that data
The attack is drawn as one tidy chain to show how layers work. Real incidents vary: attackers try many routes at once, and an organisation needs every layer at the same time, not one after another. MFA codes and push taps can still be tricked out of people by some fake pages. CISA recommends phishing-resistant MFA, such as FIDO security keys or passkeys, especially for email and other important accounts.