Cybersecurity Foundations and Terminology

Introduction

Cybersecurity is the disciplined practice of protecting digital systems, networks, applications, devices, information, and the people who use them from unauthorized access, misuse, disruption, alteration, destruction, and unlawful disclosure. It is both a technical and organizational responsibility. Firewalls, encryption, secure software, and monitoring are important, but they cannot provide effective protection when policies are weak, staff are unprepared, suppliers are untrusted, or physical facilities are insecure.

Cybersecurity is often used interchangeably with information security, although the terms have different emphases. Information security is concerned with protecting information in any form—digital, printed, spoken, or stored on physical media. Cybersecurity focuses more specifically on digital systems and the cyber environment. In practice, the two fields overlap substantially, and sound cybersecurity depends on information-security principles.

Modern organizations depend on interconnected services such as cloud platforms, mobile devices, online banking, industrial control systems, healthcare applications, and artificial-intelligence tools. This dependence creates benefits but also increases exposure to accidents, criminal activity, espionage, insider misuse, technical failure, and natural events. A foundational understanding of cybersecurity terminology enables professionals to describe risks accurately, select proportionate controls, and communicate effectively with technical and non-technical stakeholders.

Learning Objectives

By the end of this chapter, you should be able to:

• define cybersecurity and information security;
• distinguish assets, threats, vulnerabilities, exploits, controls, and attack surfaces;
• explain the CIA triad and the related properties of authenticity, accountability, non-repudiation, and privacy;
• describe how physical, personnel, and digital security depend on one another;
• identify common categories of threat and control;
• apply foundational terminology to a practical organizational scenario; and
• recognize important ethical, governance, and professional responsibilities in cybersecurity.

The Security Problem: Protecting Value in a Connected Environment

Security begins by identifying what has value and what could cause that value to be lost. An asset may be information, hardware, software, a service, a facility, a person’s identity, or an organizational capability. A customer database is an information asset; a server is a hardware asset; an online payment service is a service asset; and public trust is an organizational asset.

The value of an asset is not limited to its purchase price. A lost database may create costs through regulatory penalties, legal claims, operational delay, fraud, and reputational damage. Similarly, the compromise of a low-cost employee account may provide an attacker with a path to highly valuable systems.

Security is therefore concerned with risk rather than with eliminating every possible problem. Risk management involves identifying possible adverse events, estimating their significance, and selecting measures that reduce risk to an acceptable level. A commonly used conceptual expression is:

Here, likelihood represents the chance that an adverse event will occur, while impact represents the magnitude of its consequences. This is a conceptual model rather than a universal calculation method. Organizations may use qualitative ratings, numerical scales, or formal quantitative analysis. The expression does not imply that risk can always be measured precisely, and likelihood and impact must be defined consistently for comparisons to be meaningful.

Core Terminology

Asset

An asset is anything valuable to an organization or individual and therefore worthy of protection. Assets include:

• data such as medical records, credentials, intellectual property, and financial information;
• technology such as laptops, servers, routers, applications, and cloud resources;
• services such as email, payment processing, manufacturing, and emergency communications;
• people, including employees, customers, contractors, and patients;
• facilities and physical infrastructure; and
• less tangible resources such as reputation, trust, and business continuity.

Asset classification helps determine appropriate protection. For example, publicly available marketing material normally requires less confidentiality protection than unreleased product designs or patient records.

Threat

A threat is a potential cause of harm. Threats may be deliberate or accidental, human or environmental. Examples include ransomware criminals, a dishonest employee, a careless administrator, a lightning strike, a software defect, or a supplier compromise.

A threat actor is the person, group, organization, or natural force associated with a threat. Threat actors may include cybercriminals seeking financial gain, hacktivists pursuing political goals, state-sponsored groups conducting espionage, insiders abusing legitimate access, or inexperienced individuals using publicly available tools.

Vulnerability

A vulnerability is a weakness that could be exploited. Vulnerabilities may exist in software, hardware, configurations, procedures, physical locations, or human behavior. Examples include an unpatched web application, a reused password, excessive permissions, an unlocked server room, inadequate backup procedures, and insufficient security awareness.

A vulnerability is not itself an attack. It is a condition that makes harmful action possible or more likely. A vulnerability may remain harmless when no threat actor can reach it, but internet exposure, stolen credentials, or a change in business operations may increase its significance.

Exploit

An exploit is a method, technique, or code that takes advantage of a vulnerability. An exploit may involve a crafted network request, malicious file, deceptive message, stolen credential, or physical manipulation. The term can refer both to the act of exploiting a weakness and to a tool used for that purpose.

A vulnerability can exist without a known exploit, and an exploit may fail because of compensating controls. For example, a vulnerable service may be protected by network isolation, strong authentication, or application-layer monitoring.

Attack

An attack is an intentional attempt to compromise confidentiality, integrity, availability, authenticity, or another security property. Phishing, denial-of-service, credential theft, data destruction, and unauthorized privilege escalation are examples. Not every security incident is an attack: accidental disclosure, equipment failure, and misconfiguration may cause harm without hostile intent.

Security incident and breach

A security incident is an event that actually or potentially violates security policy or harms information or systems. A data breach is a type of incident involving unauthorized access to, disclosure of, or loss of protected information. Definitions vary by law and regulation, so organizations must apply the relevant jurisdictional requirements rather than assume that every incident is legally classified in the same way.

Control

A security control is a safeguard or countermeasure designed to prevent, detect, correct, deter, or reduce a security risk. Controls may be:

• Administrative or managerial: policies, risk assessments, contracts, training, and governance;
• Technical or logical: access control, encryption, firewalls, multifactor authentication, logging, and endpoint protection; or
• Physical: locks, barriers, guards, lighting, secure disposal, and environmental controls.

Controls may also be classified by purpose. Preventive controls attempt to stop an unwanted event. Detective controls identify events that have occurred or are occurring. Corrective controls restore an acceptable state after an event. Recovery controls restore operations and data, while deterrent controls discourage attempted misuse.

No single control is sufficient for every risk. Defense in depth uses multiple complementary safeguards so that failure of one layer does not automatically produce compromise. For example, a sensitive application may use secure coding, network segmentation, multifactor authentication, least privilege, logging, backup, and incident response procedures.

Attack surface

The attack surface is the collection of points through which an unauthorized party might attempt to enter, influence, disrupt, or extract value from a system. It includes internet-facing servers, exposed APIs, remote-access services, employee accounts, mobile devices, wireless networks, cloud configurations, third-party connections, removable media, and physical access points.

Attack surface is dynamic. A new application, supplier, remote-work arrangement, or connected device can create new exposure. Effective attack-surface management involves maintaining an inventory, identifying exposure, reducing unnecessary services, correcting weaknesses, and monitoring changes.

Attack surface should not be confused with attack vector. An attack vector is a particular route or technique used in an attack, such as a phishing email or compromised vendor account. The attack surface is the broader set of possible entry or influence points.

The CIA Triad

The CIA triad is a foundational model for information security. CIA stands for confidentiality, integrity, and availability. The model helps professionals identify what a security control is intended to protect, although real systems may require additional properties.

Confidentiality

Confidentiality is the property that information is not made available or disclosed to unauthorized individuals, entities, or processes. Access permissions, encryption, data classification, secure disposal, and need-to-know procedures support confidentiality.

Confidentiality is not identical to secrecy in an absolute sense. Authorized users may need access, and information may be intentionally shared. The objective is controlled disclosure according to legitimate authorization.

Integrity

Integrity is the property of accuracy, completeness, consistency, and protection from unauthorized or improper modification. Hash comparisons, digital signatures, version control, input validation, audit trails, and change-management procedures support integrity.

Integrity includes more than preventing malicious alteration. Accidental deletion, transcription errors, software defects, and synchronization failures can also damage integrity. For a financial system, changing a transaction amount without authorization is an integrity failure even if confidentiality is preserved.

Availability

Availability is the property that authorized users can access information and services when required. Redundancy, capacity planning, resilient architecture, patching, backups, disaster recovery, and denial-of-service protection support availability.

Availability is relative to business requirements. A service required continuously by emergency responders has a different availability requirement from an internal system used once per month. Availability also depends on recoverability: a service that is eventually restored may still cause serious harm if recovery takes too long.

Confidentiality, integrity, and availability can conflict. Strong security checks may reduce convenience or speed; extensive replication may improve availability while increasing confidentiality exposure; and rapid emergency access may need carefully governed exceptions to ordinary restrictions. Security design therefore requires risk-based judgment rather than maximizing one property in isolation.

Security Properties Beyond CIA

Authenticity

Authenticity is confidence that an entity, message, system, or data source is genuine. Authentication verifies identity, while authorization determines what an authenticated entity is allowed to do. Passwords, hardware tokens, certificates, biometric factors, and cryptographic signatures can contribute to authentication and authenticity.

Authenticity of data is also important. A message may be confidential but still dangerous if an attacker can replace it with a false message. Secure communication protocols commonly seek both confidentiality and authenticated integrity.

Accountability

Accountability is the ability to trace actions to responsible identities or processes. It depends on reliable identification, authorization records, logging, monitoring, and appropriate retention. Accountability supports investigations and discourages misuse.

Logs do not automatically create accountability. They must be accurate, protected from alteration, linked to meaningful identities, time-synchronized, reviewed, and retained in accordance with policy and law. Shared accounts generally weaken accountability because actions cannot readily be attributed to one person.

Non-repudiation

Non-repudiation provides evidence that helps prevent a party from falsely denying an action or transaction. Digital signatures, trusted time records, transaction logs, and contractual procedures may support it. Non-repudiation is stronger than ordinary logging in some contexts, but it is not purely a technical property. Legal enforceability depends on jurisdiction, identity assurance, key management, evidence handling, and organizational procedures.

Privacy

Privacy concerns appropriate collection, use, disclosure, retention, and disposal of information about identifiable individuals. Privacy is related to confidentiality but is broader. Confidentiality asks whether unauthorized parties can access information; privacy also asks whether the organization should collect the information, whether the purpose is legitimate, whether the person has appropriate rights, and how long the information should be retained.

Privacy principles commonly include purpose limitation, data minimization, transparency, accuracy, retention limitation, security, and accountability. Organizations must also comply with applicable privacy laws and sector-specific requirements. Privacy protection should be designed into systems rather than added only after deployment.

Physical, Personnel, and Digital Security

Cybersecurity is sometimes mistakenly treated as a purely digital activity. In reality, protection is socio-technical: technology operates within physical facilities and human organizations.

Physical security protects people, facilities, devices, media, and environmental conditions. Examples include perimeter controls, locks, access badges, visitor management, CCTV, fire suppression, temperature control, backup power, and secure destruction of storage media. An attacker who steals an unencrypted laptop may bypass many network controls.

Personnel security manages risks associated with people throughout the employment or contracting lifecycle. It may include role definition, background checks where lawful and proportionate, security training, segregation of duties, access approval, monitoring, disciplinary processes, and timely removal of access when roles change or employment ends. Personnel security must respect dignity, privacy, employment law, and due process.

Digital or logical security protects systems, accounts, networks, applications, and data through technical measures. Examples include secure configuration, patch management, identity and access management, encryption, endpoint protection, vulnerability management, network segmentation, backups, and security monitoring.

These domains are interdependent. A badge system may be undermined if staff allow tailgating. A strong password policy may fail if employees write passwords on desks. A secure cloud configuration may be ineffective if an administrator’s workstation is infected. Consequently, risk assessment should examine the complete system, including people, processes, facilities, technology, and external dependencies.

Common Security Principles and Frameworks

Several principles provide practical guidance for designing controls.

Least privilege gives users and processes only the access necessary for legitimate tasks. It limits the consequences of stolen credentials and reduces accidental misuse.

Need to know restricts access to information based on a justified business requirement. A person may be trusted generally but still not need access to every record.

Separation of duties divides sensitive responsibilities among people or systems so that one actor cannot complete a high-risk process alone. For example, one employee may prepare a payment and another approve it.

Fail-safe defaults deny access unless it is explicitly authorized. This principle should be implemented carefully so that safety-critical systems do not fail in a way that creates physical danger.

Secure by design integrates security requirements, threat analysis, testing, privacy considerations, and maintainability throughout the system lifecycle. It is usually more effective than attempting to correct fundamental weaknesses after deployment.

Zero trust is a security approach based on continuously evaluating access requests rather than assuming that users or devices are trustworthy because they are inside a network boundary. It emphasizes explicit verification, least privilege, resource protection, and ongoing monitoring. Zero trust does not mean that trust is impossible; it means that trust is limited, contextual, and subject to reassessment.

Risk-management frameworks and standards provide structured vocabulary and processes. Examples include the NIST Cybersecurity Framework, ISO/IEC 27001 information-security management systems, and the CIS Critical Security Controls. These frameworks do not replace professional judgment. Their suitability depends on organizational size, sector, legal obligations, risk tolerance, and available resources.

A Practical Method for Analysing a Security Problem

A beginner can approach a security problem systematically:

1. Identify assets. Determine what information, systems, services, people, and facilities matter.
2. Identify requirements. Establish confidentiality, integrity, availability, privacy, safety, and legal needs.
3. Map dependencies and attack surface. Record users, devices, suppliers, interfaces, physical locations, and external connections.
4. Identify threats and vulnerabilities. Consider deliberate attacks, accidents, failures, environmental events, and insider misuse.
5. Assess risk. Estimate likelihood and impact using a consistent method.
6. Select controls. Prefer layered, proportionate controls that address prevention, detection, response, and recovery.
7. Test and monitor. Verify that controls work and detect changes in exposure.
8. Review and improve. Update the assessment after incidents, system changes, new threats, or changes in law.

This process is iterative. Security is not a one-time installation or certification exercise.

Applied Case: A Small Healthcare Clinic

Background

The following is an illustrative case. A small healthcare clinic uses a cloud-based patient-record system, internet-connected diagnostic devices, email, and laptops used by clinicians. The clinic has eight employees and contracts an external IT provider.

Problem

An employee receives a convincing email that appears to come from the IT provider and enters credentials into a fraudulent website. The attacker uses the credentials to access email and attempts to reach patient records. At the same time, one diagnostic device uses an outdated operating system, and the server room is accessible to several non-IT employees.

Analysis

The clinic’s assets include patient records, diagnostic results, employee identities, devices, the clinical service, and patient trust. Threats include credential theft, ransomware, unauthorized disclosure, device compromise, and insider misuse. Vulnerabilities include single-factor authentication, inadequate verification of supplier messages, outdated software, broad access permissions, and weak physical access control.

The primary CIA consequences are significant. Unauthorized access threatens confidentiality and privacy. Alteration of clinical information threatens integrity and patient safety. A ransomware infection or unavailable cloud service threatens availability and continuity of care. Authenticity is also important because clinicians must be able to trust that records and diagnostic results came from legitimate sources.

Approach and Solution

The clinic prioritizes controls according to risk:

• multifactor authentication is enabled for email and the patient-record system;
• access is reviewed using least privilege and role-based permissions;
• staff receive phishing and verification training, including a procedure for confirming unusual supplier requests;
• the diagnostic device is isolated through network segmentation and placed on a supported update plan;
• immutable or offline-capable backups are tested through restoration exercises;
• email and endpoint monitoring are configured, with alerts sent to the IT provider and clinic leadership;
• the server room receives controlled access, visitor logging, and environmental protection;
• incident-response procedures define reporting, containment, legal consultation, patient notification, and recovery responsibilities; and
• supplier contracts specify security duties, breach notification, access control, and evidence preservation.

Outcome

The clinic reduces the likelihood that a stolen password alone will provide access, limits the diagnostic device’s ability to affect other systems, improves detection, and increases recovery capability. It does not eliminate risk. The clinic must continue reviewing access, testing backups, updating devices, and assessing suppliers.

Learning Points

The case demonstrates that a phishing event is not merely an employee problem. It reflects identity controls, training, supplier assurance, monitoring, privacy governance, and incident preparedness. It also shows why physical, personnel, and digital measures must be coordinated. A secure design protects patients and supports clinical operations rather than treating security as an isolated technical task.

Challenges, Ethics, and Governance

Security decisions involve trade-offs. Collecting more logs may improve accountability but increase privacy risk. Monitoring employees may detect misuse but become disproportionate or intrusive. Blocking all removable media may reduce malware risk but interfere with legitimate clinical or operational work. Controls should therefore be necessary, proportionate, transparent, and subject to review.

Professionals must obtain authorization before testing systems. Scanning or exploiting a system without permission may be unlawful even when the intention is to help. Ethical security testing defines scope, methods, timing, data handling, reporting, and stop conditions in advance. Discovered vulnerabilities should be handled responsibly, with prompt communication to authorized owners and careful protection of evidence.

Governance assigns responsibility. Senior leadership establishes risk tolerance and resources; system owners identify business requirements; security teams design and monitor controls; users follow procedures and report concerns; suppliers meet contractual obligations; and auditors provide independent assurance. Accountability cannot be delegated entirely to a security department.

Artificial intelligence can assist with alert triage, anomaly detection, code analysis, and security operations. However, AI systems can generate false positives, miss novel attacks, expose sensitive data, or be manipulated by adversarial inputs. Human oversight, data protection, access restrictions, validation, and documented decision processes remain necessary. AI is a tool within a control system, not a replacement for governance or professional judgment.

Best Practices for Beginners

A sound foundational program should:

• maintain an accurate inventory of assets and software;
• classify information and apply retention and disposal rules;
• use unique accounts, strong authentication, and least privilege;
• patch supported systems and remove unnecessary services;
• protect data in transit and at rest where appropriate;
• maintain tested backups and an incident-response plan;
• centralize and protect security logs;
• train users with realistic, recurring exercises;
• secure facilities, devices, and removable media;
• assess suppliers and cloud services; and
• measure improvement through evidence rather than assuming that a policy equals effective protection.

Chapter Summary

Cybersecurity protects digital systems, information, services, people, and organizational trust from unauthorized access, misuse, disruption, alteration, and destruction. Information security has a wider scope because it includes information in all forms. Assets are valuable resources; threats are potential causes of harm; vulnerabilities are weaknesses; exploits use vulnerabilities; attacks are deliberate attempts to compromise security; and controls reduce, detect, deter, or recover from risk. The attack surface consists of the points through which systems may be entered or influenced.

The CIA triad—confidentiality, integrity, and availability—provides a fundamental model for security objectives. Authenticity confirms that entities or information are genuine, accountability links actions to responsible identities, non-repudiation supports evidence against false denial, and privacy governs the appropriate handling of personal information. Physical, personnel, and digital security are mutually dependent. Principles such as least privilege, separation of duties, defense in depth, secure by design, and zero trust help structure protection. Effective cybersecurity is continuous, risk-based, ethical, and governed across the whole organization.

Key Terms

Asset: A resource with value that requires protection.

Attack: An intentional attempt to compromise a security property or cause harm.

Attack surface: The collection of points through which a system may be attacked or influenced.

Authentication: Verification of an entity’s claimed identity.

Authenticity: Confidence that an entity, message, or data source is genuine.

Availability: The property that authorized users can access systems or information when needed.

Confidentiality: Protection against unauthorized disclosure.

Control: A safeguard or countermeasure that manages security risk.

Exploit: A method or code that takes advantage of a vulnerability.

Integrity: Protection of information against unauthorized or improper alteration, including preservation of accuracy and completeness.

Least privilege: Granting only the access necessary for an authorized task.

Non-repudiation: Evidence supporting the claim that a party performed an action or created a transaction.

Privacy: Appropriate control over the collection, use, disclosure, retention, and disposal of personal information.

Risk: The possibility of adverse consequences arising from threats and vulnerabilities.

Security incident: An event that actually or potentially violates security policy or harms systems or information.

Threat: A potential cause of harm.

Threat actor: A person, group, organization, or force associated with a threat.

Vulnerability: A weakness that may be exploited.

Review Questions

Short Answer Questions

1. What is the difference between cybersecurity and information security?
2. Define an asset, threat, vulnerability, and exploit.
3. What are the three elements of the CIA triad?
4. Why does privacy involve more than confidentiality?
5. Give two examples of physical security controls and two examples of digital security controls.

Long Answer Questions

1. Explain how confidentiality, integrity, and availability can conflict in the design of a real system.
2. Describe defense in depth and explain why a single security control is rarely sufficient.
3. Explain the relationship among authentication, authorization, accountability, and non-repudiation.
4. Discuss how personnel security and physical security contribute to cybersecurity.
5. Describe a systematic process for analysing the security of a new online service.

Analytical / Application Questions

1. A university discovers that a public-facing application has an unpatched vulnerability, but the application is protected by multifactor authentication and network segmentation. Analyse the remaining risk and recommend additional controls.
2. An employee with legitimate access downloads a confidential customer file to an unmanaged personal device. Identify the relevant assets, threats, vulnerabilities, security properties, and possible controls.
3. A small business wants to deploy an AI-based system to monitor employee activity for security purposes. Evaluate the potential benefits, privacy and ethical risks, and governance measures that should be established before deployment.

Multiple Choice Questions with Answers

Question 1

Which statement best defines a vulnerability?

A. A valuable resource that requires protection

B. A weakness that may be exploited

C. A method used to take advantage of a weakness

D. A safeguard designed to reduce risk

Correct Answer: B. A weakness that may be exploited

Question 2

Which CIA triad property is primarily threatened when an attacker changes a patient’s diagnosis?

A. Confidentiality

B. Availability

C. Integrity

D. Privacy

Correct Answer: C. Integrity

Question 3

Which control is primarily preventive?

A. A firewall blocking unauthorized traffic

B. A report reviewing last month’s incidents

C. A forensic investigation after compromise

D. A backup used to restore deleted files

Correct Answer: A. A firewall blocking unauthorized traffic

Question 4

What is the main purpose of least privilege?

A. To ensure every employee can access all systems

B. To provide only the access necessary for an authorized task

C. To eliminate the need for authentication

D. To make systems available without interruption

Correct Answer: B. To provide only the access necessary for an authorized task

Question 5

Which example most directly demonstrates accountability?

A. Encrypting a database

B. Keeping a protected log that links an administrative action to a named user

C. Installing an extra power supply

D. Publishing a public website

Correct Answer: B. Keeping a protected log that links an administrative action to a named user

Question 6

Why is privacy broader than confidentiality?

A. Privacy applies only to physical documents

B. Privacy also concerns whether information should be collected, used, and retained

C. Confidentiality never involves access control

D. Privacy requires all information to be public

Correct Answer: B. Privacy also concerns whether information should be collected, used, and retained

Question 7

Which situation illustrates an attack-surface change?

A. An organization removes an unused internet-facing service

B. An organization adds a remote-access portal for suppliers

C. An employee reads an approved internal policy

D. A backup is successfully restored during a test

Correct Answer: B. An organization adds a remote-access portal for suppliers

Question 8

Which statement about non-repudiation is most accurate?

A. It guarantees that no security incident can occur

B. It is identical to availability

C. It provides evidence that can help prevent false denial of an action

D. It means that every user must have administrator access

Correct Answer: C. It provides evidence that can help prevent false denial of an action

Question 9

A clinic separates a vulnerable diagnostic device from its main office network. Which principle or control approach is this?

A. Network segmentation and defense in depth

B. Data minimization only

C. Non-repudiation only

D. Public disclosure

Correct Answer: A. Network segmentation and defense in depth

Question 10

Which statement best describes a threat?

A. A potential cause of harm

B. A confirmed record of unauthorized access

C. A security policy document

D. A method for encrypting information

Correct Answer: A. A potential cause of harm