Cybersecurity in Simple Terms
Cybersecurity means protecting people, devices, networks, systems, and data from unauthorized access, attacks, and misuse.
The easiest way for me to understand cybersecurity is:
Find what needs protection → understand what could go wrong → reduce the risk → monitor for problems → investigate → respond → improve.
What Are We Protecting?
Cybersecurity mainly protects:
People — users, employees, customers
Devices — computers, phones, servers
Networks — connections between devices
Systems — applications and services
Data — personal, business, financial, or confidential information
A threat actor is a person or group that may cause a security problem.
The CIA Triad
The CIA Triad is one of the most important ideas in cybersecurity.
Confidentiality
Only authorized people should be able to access information.
Example: Other students should not be able to see my school account password.
Integrity
Information should remain correct and should not be changed without permission.
Example: Someone should not be able to secretly change my grades in a database.
Availability
Systems and information should be accessible when authorized users need them.
Example: A school's website should still work when students need to enroll.
So:
Confidentiality = keep it secret
Integrity = keep it correct
Availability = keep it accessible
The CIA Triad helps organizations decide how systems and information should be protected.
Threats, Vulnerabilities, and Risk
These three concepts are closely connected.
Threat
Something that could cause harm.
Example: an attacker trying to steal data.
Vulnerability
A weakness that could be exploited.
Example: an outdated application with a security flaw.
Risk
The possibility that a threat will successfully exploit a vulnerability and cause damage.
A simple way to think about it:
Threat + Vulnerability = Risk
Security professionals try to reduce risk by applying security controls.
Security Control
A security control is a safeguard used to reduce a specific security risk.
Examples include:
passwords and access control
encryption
antivirus
monitoring
security policies
secure system configurations
Common Attacks
Phishing
Phishing uses emails, messages, or other digital communication to trick someone into revealing sensitive information or installing malicious software.
Malware
Malware is software intentionally designed to harm a computer, device, or network.
Social Engineering
Social engineering attacks the person instead of the technology. The attacker manipulates someone into giving information, access, or something valuable.
This helped me understand that people are also part of cybersecurity. Even a secure computer can become vulnerable if someone is tricked into giving away their password.
How Organizations Manage Security
Organizations usually do not randomly decide how to protect themselves.
They use security frameworks, controls, policies, regulations, and standards.
Security Framework
A security framework gives organizations guidelines for managing cybersecurity risks.
The basic process is:
Identify security goals.
Create guidelines.
Implement security processes.
Monitor the results.
Examples introduced in the course include:
NIST Cybersecurity Framework
CIS Controls
GDPR — protection of personal information in the EU
HIPAA — protection of health information in the U.S.
PCI DSS — protection of payment-card information
FedRAMP — security requirements for U.S. government cloud services
ISO — international standards
SOC 1 / SOC 2 — reports used to assess organizational controls and risk
I do not need to memorize every regulation immediately. The important idea is:
Different organizations have different security responsibilities depending on what they do and what information they handle.
What Does a Cybersecurity Analyst Do?
A security analyst helps monitor and protect an organization's information and systems.
Some responsibilities include:
protecting computer and network systems
monitoring security activity
using preventive security tools
conducting security audits
investigating suspicious activity
Security analysts need both technical and non-technical skills.
Transferable Skills
communication
collaboration
analysis
problem-solving
Technical Skills
security tools
programming
networking
operating systems
databases
computer forensics
Important Cybersecurity Tools
SIEM
A SIEM collects and analyzes logs from different systems.
A log is simply a record of something that happened on a system.
Instead of manually reading thousands of logs:
Systems → Logs → SIEM → Alert → Analyst investigates
SIEM tools help analysts find suspicious events faster.
Network Protocol Analyzer
Also called a packet sniffer.
It captures and analyzes network traffic so analysts can see how devices are communicating.
IDS
An Intrusion Detection System (IDS) monitors activity and generates alerts when it detects possible intrusions or suspicious network traffic.
Antivirus
Antivirus or anti-malware software helps prevent, detect, and remove malware.
Encryption
Encryption turns readable information into protected information.
Plaintext → Encryption → Ciphertext
Its main purpose is to protect confidentiality.
Encryption is different from encoding. Encoding changes how information is represented; encryption is meant to protect the information from unauthorized users.
Programming, Linux, and SQL
Cybersecurity analysts can use:
Python — automate repetitive tasks.
SQL — search and work with information stored in databases.
Linux — interact with systems using commands and a command-line interface.
Penetration Testing
Penetration testing is a controlled simulated attack used to find weaknesses before real attackers can exploit them.
Incident Response and Evidence
When something suspicious happens, analysts should not simply start changing things randomly.
Organizations use playbooks, which are documented instructions explaining what analysts should do during specific situations.
Two important forensic concepts are:
Chain of Custody
Keep a record of:
who handled evidence
what the evidence is
where it was stored
when it was moved
why it was handled
Protecting Evidence
Digital evidence can easily be changed or lost.
Analysts should preserve the original evidence and normally investigate using copies.
Some information is volatile, meaning it may disappear when a computer is shut down, so evidence sometimes needs to be collected in a specific order.
Ethics
Cybersecurity professionals may have access to private systems and sensitive information, so being ethical is extremely important.
Security professionals should:
protect confidential information
respect people's privacy
remain unbiased
follow the law
rely on evidence
act honestly and responsibly
continue improving their knowledge
The goal is to defend and protect, not to take revenge against attackers.
The Fundamentals in One Example
Imagine a company has a database containing customer information.
That is essentially what cybersecurity is about.