Cybersecurity Foundations and Terminology

Introduction

Cybersecurity is the disciplined protection of digital systems, networks, applications, information, and people from harm caused by accidental events, technical failure, misuse, or deliberate attack. It is not limited to installing antivirus software or blocking hackers. It involves identifying what must be protected, understanding how it could be harmed, reducing the likelihood and impact of harmful events, detecting incidents, responding effectively, and restoring dependable operations.

Modern organisations depend on information technology for communication, banking, healthcare, manufacturing, education, transport, and public services. This dependence creates value but also creates exposure. A weakness in an internet-facing application, an incorrectly configured cloud service, a stolen password, or an unavailable data centre may produce financial, legal, operational, and safety consequences.

This chapter establishes the vocabulary and conceptual models used throughout cybersecurity and cryptography. It distinguishes related disciplines and explains how professionals reason about protection priorities.

Learning Objectives

After studying this chapter, you should be able to:

• identify assets and explain their value;
• distinguish threats, vulnerabilities, exploits, events, and incidents;
• explain risk as a combination of likelihood and impact;
• describe preventive, detective, corrective, deterrent, and compensating controls;
• analyse attack surfaces and attack paths;
• apply the confidentiality–integrity–availability (CIA) triad;
• distinguish cybersecurity, information security, privacy, and resilience;
• use foundational terminology in a practical security assessment;
• recommend proportionate controls for a realistic organisational scenario.

1. Security as a Risk-Management Discipline

Security decisions are risk-management decisions. No system can be made perfectly secure, and no organisation has unlimited money, time, or personnel. The professional task is therefore to understand important risks and select controls that reduce them to an acceptable level while preserving legitimate business activity.

A useful conceptual model is:

Likelihood describes how probable a harmful event is within a defined period. Impact describes the consequences if it occurs. This relationship is a model rather than a universal law: organisations may use qualitative categories, numerical scales, annual loss estimates, or more sophisticated risk models. The multiplication is meaningful only when the scales and assumptions are defined consistently.

For example, if a team rates likelihood from 1 to 5 and impact from 1 to 5, a risk score may be calculated as:

where L is the likelihood rating and I is the impact rating. A likelihood of 4 and an impact of 5 produces a score of 20 on that local scale. It does not mean that the event has a 20 percent probability, nor that every organisation should rank it identically.

Risk assessment normally involves four activities:

1. identifying assets and business processes;
2. identifying threats and vulnerabilities;
3. estimating likelihood and impact;
4. selecting and monitoring risk treatments.

Risk treatment may involve reducing risk through controls, avoiding the activity, transferring some financial consequences through insurance or contracts, or accepting the risk formally. Acceptance should be informed and authorised, not simply the result of neglect.

2. Assets and Their Value

An asset is anything valuable to an organisation or individual and therefore worthy of protection. Assets include more than files and computers. They may include:

• data, such as customer records, passwords, research, and financial information;
• hardware, including servers, laptops, sensors, and networking equipment;
• software, applications, operating systems, and source code;
• services, such as online banking, email, identity management, or emergency communications;
• people, skills, reputation, and institutional knowledge;
• facilities, power systems, and physical environments;
• business processes and intellectual property.

Asset value depends on context. A public marketing brochure may have low confidentiality requirements but high availability requirements during a product launch. A database containing medical records may require strong confidentiality and integrity, while an industrial safety controller may require especially high integrity and availability.

Asset owners are accountable for determining an asset’s importance, acceptable use, retention, and protection requirements. Custodians or administrators operate controls on behalf of the owner. Users are expected to handle the asset according to policy.

Data classification

Organisations commonly classify information according to sensitivity and business value. A simple scheme might contain public, internal, confidential, and highly restricted categories. Classification should lead to practical handling rules, such as encryption, access approval, retention limits, secure disposal, and monitoring. Labels alone provide no protection unless they are connected to enforceable processes and technical controls.

3. Threats, Threat Actors, and Events

A threat is a potential cause of harm. Threats may be intentional or accidental, internal or external, human or environmental.

A threat actor is the person, group, organisation, or natural force capable of carrying out a threat. Examples include:

• cybercriminals seeking money;
• insiders misusing legitimate access;
• hacktivists pursuing political objectives;
• state-sponsored groups conducting espionage or disruption;
• careless employees;
• suppliers whose systems are compromised;
• storms, floods, fires, and power failures.

Threat capability, motivation, opportunity, and access influence the likelihood of an attack. A highly capable attacker may still pose little immediate risk if the organisation is not an attractive target or if effective controls prevent access.

A threat event is an occurrence that may affect an asset. An event becomes a security incident when it actually or potentially violates security policy, threatens operations, or compromises confidentiality, integrity, or availability. A confirmed data breach is an incident; a blocked suspicious login may be a security event and may or may not become an incident depending on organisational criteria.

4. Vulnerabilities, Exploits, and Attack Paths

A vulnerability is a weakness that can be used or triggered to cause harm. Vulnerabilities may exist in software, hardware, configuration, procedures, physical facilities, or human behaviour. Examples include an unpatched web server, excessive user privileges, weak passwords, exposed backup media, and inadequate separation of duties.

An exploit is a method, technique, or code that takes advantage of a vulnerability. The vulnerability is the weakness; the exploit is the means of using it. A vulnerability may exist without being exploited, and an exploit may be ineffective when compensating controls block it.

An attack is an intentional attempt to compromise an asset or security property. Common attack techniques include phishing, credential theft, malware, denial-of-service, unauthorised privilege escalation, social engineering, and exploitation of vulnerable applications.

An attack surface is the total set of points through which an attacker might attempt to enter, influence, or extract value from a system. It includes internet-facing services, APIs, remote-access tools, mobile devices, cloud identities, third-party connections, removable media, physical entrances, and human processes. Reducing attack surface may involve disabling unused services, limiting exposure, removing obsolete accounts, segmenting networks, and reducing unnecessary privileges.

An attack path is a sequence of actions or conditions leading from an entry point to a target. For example, an attacker might send a phishing message, obtain a password, bypass weak multi-factor authentication, access a cloud account, and download confidential files. Attack-path analysis helps defenders identify where prevention, detection, or containment will be most effective.

Exposure, weakness, and misconfiguration

Exposure is the condition of being accessible to a threat. A database exposed to the public internet is more exposed than the same database restricted to a protected internal network. Misconfiguration is an incorrect or unsafe setting, such as a storage bucket that permits public access. Misconfiguration is a major practical source of vulnerabilities because systems are often deployed rapidly and changed continuously.

5. The CIA Triad

The CIA triad is a foundational model consisting of confidentiality, integrity, and availability. It is used to describe security objectives and to evaluate controls.

Confidentiality

Confidentiality means preventing unauthorised disclosure of information. It is supported by access control, encryption, authentication, data classification, secure disposal, and awareness training. A confidentiality failure occurs when an unauthorised person reads, receives, or infers protected information.

Confidentiality is not identical to secrecy. Some information may legitimately be shared with authorised parties. The objective is controlled disclosure, not universal concealment.

Integrity

Integrity means protecting information and systems from unauthorised or improper modification, destruction, or manipulation. Integrity controls include cryptographic hashes, digital signatures, change control, input validation, audit logs, segregation of duties, and version management.

Integrity also includes authenticity in many contexts: users need confidence that data came from the claimed source and was not altered improperly. A modified payment instruction, falsified examination result, or altered safety setting illustrates an integrity failure.

Availability

Availability means that authorised users can access systems and information when required. Availability depends on capacity, maintenance, redundancy, backups, resilient architecture, physical protection, and recovery procedures. Denial-of-service attacks, ransomware, equipment failure, and power loss can all affect availability.

Confidentiality, integrity, and availability can conflict. Strong access restrictions may improve confidentiality but reduce availability if legitimate users are blocked. Frequent emergency changes may improve short-term availability but threaten integrity. Security engineering therefore requires balanced, risk-based decisions.

6. Controls and Defensive Measures

A security control is a safeguard or countermeasure that modifies risk. Controls may be technical, administrative, physical, or procedural.

A control may serve several purposes. Multi-factor authentication primarily prevents unauthorised access, while authentication logs provide detective capability. Backups support recovery but do not prevent data theft.

Administrative, technical, and physical controls

Administrative controls include policies, risk assessments, contracts, training, background checks, and incident procedures. Technical controls include encryption, firewalls, identity systems, endpoint protection, secure coding, and monitoring. Physical controls include locks, barriers, guards, environmental controls, and secure disposal facilities.

Effective security uses defence in depth: multiple complementary controls so that failure of one layer does not automatically produce compromise. Controls should also follow least privilege, separation of duties, secure defaults, fail-safe design, and continuous review.

Control effectiveness

A control is effective only if it is correctly designed, implemented, used, and maintained. A policy requiring strong passwords is weak protection if passwords are not technically enforced, compromised credentials are not monitored, or users are not supported with secure authentication methods. Control assessment should consider coverage, reliability, usability, evidence, and residual risk.

7. Cybersecurity, Information Security, Privacy, and Resilience

These terms overlap but are not interchangeable.

Information security is the protection of information and information systems against unauthorised access, use, disclosure, disruption, modification, or destruction. It applies to information in digital, paper, verbal, and other forms.

Cybersecurity focuses particularly on protecting digital systems, networks, connected devices, software, and data from cyber threats. It is commonly treated as a major component of information security, although professional definitions and organisational boundaries vary.

Privacy concerns the appropriate collection, use, sharing, retention, and disposal of information about identifiable people. Privacy includes individual rights, transparency, purpose limitation, data minimisation, lawful processing, and respect for personal autonomy. Security supports privacy, but security alone does not guarantee it. An organisation could securely collect excessive personal data and use it in an unfair or unauthorised way.

Resilience is the ability to continue delivering important outcomes during disruption and to adapt, respond, recover, and improve afterward. Cyber resilience includes preparation, resistance, detection, response, recovery, and learning. Resilience is broader than prevention: it assumes that some incidents will occur and asks whether essential operations can survive them.

8. Governance, Ethics, and Professional Responsibility

Cybersecurity is governed by law, regulation, contracts, professional standards, and organisational policy. Requirements vary by jurisdiction and sector, but commonly include breach reporting, protection of personal data, retention rules, financial controls, health information safeguards, and critical-infrastructure obligations. Professionals must understand which requirements apply and must preserve evidence for audits or investigations.

Ethical practice requires authorisation, proportionality, respect for privacy, competence, honesty, and responsible disclosure. Security testing must have defined scope, written permission, safety controls, and rules for handling discovered data. Scanning or exploiting systems without authority may be unlawful even when the intention is educational.

Security decisions also have human consequences. Excessive surveillance, discriminatory automated decisions, inaccessible authentication, and burdensome controls can harm legitimate users. Good governance balances protection with fairness, usability, accountability, and the principle of collecting only information necessary for a legitimate purpose.

9. Practical Risk Assessment Workflow

A diploma-level practitioner can use the following workflow for an initial assessment:

1. Define scope. Identify systems, locations, processes, owners, and time period.
2. Identify assets. Record data, services, devices, people, and dependencies.
3. Establish security requirements. Determine confidentiality, integrity, availability, privacy, and recovery needs.
4. Identify threats. Consider criminal, insider, accidental, supplier, and environmental sources.
5. Find vulnerabilities and exposures. Review configurations, software versions, permissions, interfaces, and procedures.
6. Map attack paths. Determine how an attacker or failure could reach important assets.
7. Estimate risk. Assess likelihood and impact using documented assumptions.
8. Select controls. Prefer layered, proportionate controls that address root causes.
9. Assign responsibility. Specify owners, deadlines, evidence, and escalation routes.
10. Monitor residual risk. Reassess after changes, incidents, new threats, or control failures.

Risk registers commonly record the asset, threat, vulnerability, existing controls, likelihood, impact, risk rating, treatment, owner, and review date. A register is useful only when it leads to decisions and is kept current.

10. Illustrative Case: Community Health Clinic

Background

A small community health clinic uses a cloud appointment system, electronic patient records, email, wireless networks, and internet-connected diagnostic devices. It has 35 employees and limited technical staff.

Problem

A receptionist receives a convincing message requesting an urgent password reset. The link leads to a fraudulent login page. The attacker obtains the receptionist’s password and accesses email. The clinic also discovers that several staff accounts have excessive privileges and that backups have not been tested for nine months.

Analysis

The patient-record system is a high-value asset. Confidentiality is essential because records contain sensitive personal information. Integrity is essential because incorrect records can affect treatment. Availability is essential because clinicians need records during appointments.

The phishing message is the threat event. The stolen password is a credential compromise. Excessive privileges and weak authentication are vulnerabilities. The likely attack path is phishing → account takeover → access to email or cloud applications → search for patient information → data disclosure or manipulation.

The risk is increased by inadequate monitoring, untested backups, and dependence on a cloud identity provider. The clinic should not assume that cloud hosting transfers all responsibility; the provider and clinic retain different security duties.

Approach and solution

The clinic prioritises the following measures:

• enable phishing-resistant or app-based multi-factor authentication;
• reduce privileges using role-based access and least privilege;
• disable inactive accounts and review external sharing;
• provide practical phishing awareness and reporting training;
• configure email authentication and filtering;
• centralise logs for identity and record access;
• encrypt devices and protect recovery credentials;
• maintain offline or logically isolated backups;
• test restoration and document recovery targets;
• establish an incident procedure for account compromise and possible breach notification.

Outcome

The clinic cannot eliminate phishing, but it reduces the probability that a stolen password alone will provide access. Monitoring improves detection, privilege reduction limits impact, and tested backups improve recovery. Regular reviews are scheduled because staff, applications, threats, and legal requirements change.

Learning points

The case demonstrates that security is a system of interacting controls rather than a single product. It also shows why confidentiality, integrity, and availability must be considered together. A control that blocks all access would not be acceptable if clinicians could not treat patients; a control that maximises convenience might expose records. Risk-based design seeks an appropriate balance.

11. Contemporary Developments and Limitations

Cloud computing, mobile work, software supply chains, operational technology, application programming interfaces, and artificial intelligence have expanded attack surfaces. Identity has become a central security boundary because users and services access resources from many locations. Zero-trust approaches therefore emphasise continuous verification, explicit authorisation, least privilege, and assuming that networks may already be compromised.

Artificial intelligence can assist defenders with log analysis, malware classification, vulnerability prioritisation, and drafting incident reports. It can also help attackers produce convincing phishing messages, discover weaknesses, and automate reconnaissance. AI output may be inaccurate, biased, or confidentially sensitive. Human review, access controls, testing, and clear accountability remain necessary.

No framework captures every security concern. The CIA triad may underemphasise safety, authenticity, accountability, or non-repudiation. Risk scores can create false precision. Compliance can encourage checklist behaviour rather than real protection. Security tools generate alerts but do not automatically produce understanding. Professionals must therefore combine models with contextual judgement, evidence, and continual improvement.

Best-Practice Principles

• Know what assets exist and who owns them.
• Classify information and apply handling requirements.
• Minimise attack surface and unnecessary privileges.
• Use layered controls and secure defaults.
• Separate prevention, detection, response, and recovery capabilities.
• Protect credentials with strong authentication and careful lifecycle management.
• Patch and securely configure systems according to risk.
• Log important activity and protect logs from unauthorised alteration.
• Maintain tested, recoverable backups.
• Train people without blaming them for system weaknesses.
• Treat suppliers and cloud services as part of the security environment.
• Review controls after incidents, major changes, and new threats.
• Document decisions, assumptions, ownership, and residual risk.

Chapter Summary

Cybersecurity protects digital assets and services from intentional and accidental harm. An asset has value; a threat is a potential cause of harm; a vulnerability is a weakness; an exploit is a method of using that weakness; and an incident is a security-relevant event requiring attention. Risk is assessed by considering likelihood and impact, then treated through proportionate controls.

Controls may be preventive, detective, corrective, deterrent, recovery, or compensating, and may be administrative, technical, or physical. Defence in depth, least privilege, secure configuration, monitoring, and tested recovery are foundational practices. The CIA triad expresses three central objectives: confidentiality, integrity, and availability.

Cybersecurity concentrates on digital systems, information security covers information in all forms, privacy concerns appropriate handling of personal information, and resilience concerns continued operation and recovery during disruption. These disciplines overlap but answer different questions. Effective professionals apply the concepts together, recognising legal, ethical, human, and operational responsibilities.

Key Terms

Asset: Anything valuable that requires protection.

Attack surface: The total set of possible points through which a system may be attacked.

Attack path: A sequence of steps or conditions leading from an entry point to a target.

Availability: The property that authorised users can access systems and information when needed.

Confidentiality: Protection against unauthorised disclosure.

Control: A safeguard or countermeasure that modifies risk.

Cybersecurity: Protection of digital systems, networks, devices, applications, and data from cyber threats.

Exploit: A technique, method, or code that takes advantage of a vulnerability.

Incident: An event that actually or potentially violates security requirements or threatens operations.

Integrity: Protection against unauthorised or improper modification or destruction.

Likelihood: An assessment of how probable a harmful event is within a defined context.

Privacy: Appropriate and lawful collection, use, sharing, retention, and disposal of personal information.

Resilience: The ability to withstand, respond to, recover from, and adapt after disruption.

Risk: The potential for adverse consequences arising from uncertainty and harmful events.

Threat: A potential cause of harm.

Threat actor: A person, group, organisation, or force capable of causing harm.

Vulnerability: A weakness that can be exploited or triggered.

Zero trust: An approach based on explicit verification, least privilege, and no automatic trust based solely on network location.

Review Questions

Short Answer Questions

1. What is the difference between a vulnerability and an exploit?
2. Define confidentiality, integrity, and availability.
3. Why is an asset owner important in security governance?
4. Name three types of security controls and give one example of each.
5. How does privacy differ from information security?

Long Answer Questions

1. Explain the risk-management process from asset identification through residual-risk monitoring.
2. Discuss how defence in depth and least privilege reduce the impact of compromise.
3. Compare cybersecurity, information security, privacy, and resilience.
4. Explain how an organisation can reduce its attack surface.
5. Discuss the strengths and limitations of the CIA triad as a security model.

Analytical / Application Questions

1. A university exposes a student database to the internet with public read access. Identify the asset, threat, vulnerability, likely attack path, affected CIA objectives, and suitable controls.
2. A factory’s safety monitoring system is unavailable for four hours after a ransomware incident, but no data is disclosed. Analyse the incident using the CIA triad and recommend recovery and preventive measures.
3. A company wants to use an AI system to analyse employee messages for insider-threat indicators. Evaluate the proposal from security, privacy, ethical, governance, and resilience perspectives.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes a vulnerability from an exploit?

A. A vulnerability is a weakness; an exploit is a method of using it.

B. A vulnerability is an incident; an exploit is a control.

C. A vulnerability is an asset; an exploit is its owner.

D. A vulnerability is impact; an exploit is likelihood.

Correct Answer: A. A vulnerability is a weakness; an exploit is a method of using it.

Question 2

Which CIA property is primarily affected when an unauthorised person reads patient records?

A. Availability

B. Confidentiality

C. Integrity

D. Resilience

Correct Answer: B. Confidentiality

Question 3

A risk score uses likelihood L and impact I on consistent five-point scales. If L=4 and I=3, what is the score?

A. 1

B. 7

C. 12

D. 20

Correct Answer: C. 12

Question 4

Which is a detective control?

A. Network monitoring and alerting

B. Disabling unused accounts before deployment

C. A firewall rule blocking an unauthorised port

D. Restoring data from a backup

Correct Answer: A. Network monitoring and alerting

Question 5

What is an attack surface?

A. The financial cost of an incident

B. The total set of possible points through which a system may be attacked

C. A list of authorised employees

D. The encryption key length of a system

Correct Answer: B. The total set of possible points through which a system may be attacked

Question 6

Which statement about privacy is most accurate?

A. Privacy is identical to confidentiality.

B. Privacy concerns appropriate handling of personal information, including collection and use.

C. Privacy applies only to passwords.

D. Privacy is achieved whenever data is encrypted.

Correct Answer: B. Privacy concerns appropriate handling of personal information, including collection and use.

Question 7

Which measure most directly supports availability after ransomware?

A. Tested, recoverable backups

B. Publicly sharing system credentials

C. Removing all access controls

D. Disabling incident reporting

Correct Answer: A. Tested, recoverable backups

Question 8

A stolen password is used to enter a cloud account, access email, and download records. This sequence is best described as a(n):

A. Attack path

B. Asset classification

C. Compensating control

D. Privacy notice

Correct Answer: A. Attack path

Question 9

Which principle limits users and services to only the access they need?

A. Least privilege

B. Open disclosure

C. Maximum exposure

D. Single-point dependency

Correct Answer: A. Least privilege

Question 10

Which statement best describes resilience?

A. Preventing every possible incident

B. Keeping all information secret from everyone

C. Continuing important operations and recovering and adapting after disruption

D. Replacing risk assessment with compliance checklists

Correct Answer: C. Continuing important operations and recovering and adapting after disruption