Cybersecurity Foundations and Terminology

Introduction

Modern organisations depend on information assets, digital services, connected devices and communications networks. Banking, healthcare, education, government, manufacturing and personal life all rely on systems that must remain trustworthy. A failure of security can expose confidential records, alter decisions, interrupt essential services, cause financial loss or endanger people.

Cybersecurity provides the concepts and practices used to reduce these risks. It is not limited to installing antivirus software or building technical barriers. Effective security also involves people, policies, physical environments, suppliers, law, governance and responsible decision-making. This chapter introduces the vocabulary and foundational models required for later study of cryptography, secure networks, vulnerability management, incident response and security governance.

Learning Objectives

By the end of this chapter, you should be able to:

• identify information assets and explain their value;
• describe cyberspace and the components that form it;
• distinguish attack surfaces, threats, vulnerabilities, exploits and risks;
• explain preventive, detective, corrective and deterrent controls;
• apply the confidentiality–integrity–availability triad to practical situations;
• distinguish cybersecurity from information security, privacy, safety and resilience;
• classify security events using accurate professional terminology; and
• analyse a basic organisational security scenario and recommend appropriate controls.

Information Assets and Their Value

An asset is anything valuable that an organisation or individual wants to protect. An information asset is information itself or a resource that stores, processes, transmits or supports information. Examples include customer databases, employee records, source code, research results, passwords, encryption keys, business plans, cloud accounts, laptops, servers, applications and network infrastructure.

Information has value for several reasons. It may support operations, provide legal evidence, represent intellectual property, enable revenue, protect safety or preserve public trust. The value of an asset is not necessarily determined by its size. A small file containing a private cryptographic key may be more valuable than a large collection of ordinary documents because compromise of the key could expose many systems.

Assets may be classified according to ownership, sensitivity, business importance or regulatory status. A typical classification scheme is:

Classification should lead to action. A restricted asset may require strong authentication, encryption, access logging, retention limits and formal approval for use. Labelling information without changing its handling practices provides little protection.

The asset perspective also includes dependencies. A payroll database depends on servers, operating systems, administrators, identity services, electricity, networks and backup systems. Therefore, protecting the database requires more than protecting its data file.

Cyberspace and the Cybersecurity Environment

Cyberspace is the interconnected environment formed by information and communication technologies, the data they contain, the people who use them and the processes that govern their operation. It includes the public internet, private networks, cloud platforms, mobile devices, industrial control systems, embedded devices and the human relationships surrounding them.

A useful way to understand cyberspace is as an ecosystem with four interacting elements:

1. People: users, administrators, customers, attackers, suppliers and decision-makers.
2. Processes: authentication, procurement, software development, incident response and business operations.
3. Technology: hardware, software, networks, applications, sensors and cloud services.
4. Data: credentials, records, configurations, messages, logs and intellectual property.

Security weaknesses frequently occur at the boundaries between these elements. For example, a technically secure application may still be exposed if staff are not trained to identify fraudulent requests. Similarly, a strong password policy may fail if a supplier retains uncontrolled administrative access.

Cybersecurity is therefore socio-technical. It requires technical safeguards but also sound governance, usable procedures, informed users and accountable leadership.

Threats, Threat Actors and Events

A threat is a potential cause of harm to an asset or organisation. Threats may be intentional, accidental or environmental. Examples include ransomware, phishing, equipment failure, natural disasters, insider misuse and software defects.

A threat actor is an individual or group capable of carrying out a threat. Threat actors include cybercriminals, nation-state groups, hacktivists, competitors, careless employees and malicious insiders. Their capability, motivation, resources and access differ considerably.

A security event is an observable occurrence relevant to security, such as repeated failed logins, an unexpected configuration change or an alert from an intrusion detection system. An event is not automatically an incident.

A security incident is an event, or series of events, that actually or potentially compromises the confidentiality, integrity or availability of information or systems, or violates security policy. A single failed login is usually an event; evidence that an attacker successfully accessed an account may constitute an incident.

A breach generally refers to unauthorised access, disclosure, acquisition or loss of protected information. Organisations should use the definitions required by applicable law and policy because regulatory meanings vary.

Attack Surfaces and Exposure

An attack surface is the collection of points at which an unauthorised party might attempt to enter, affect or extract value from a system. It includes technical, human and physical points.

Technical attack-surface elements include internet-facing servers, open ports, APIs, web applications, remote-access services, cloud storage, wireless networks, software dependencies and exposed credentials. Human elements include phishing targets, privileged administrators, help-desk procedures and third-party contacts. Physical elements include server rooms, removable media, unattended devices and network cabinets.

Attack-surface management involves identifying assets, understanding exposure, reducing unnecessary services, applying secure configurations, monitoring changes and reassessing continuously. The objective is not to eliminate every possible entry point—often impossible—but to reduce unnecessary exposure and strengthen essential points.

An attack vector is the path or method used to reach a target, such as a phishing email, stolen password, malicious attachment, vulnerable web interface or compromised supplier account.

Vulnerabilities, Exploits and Risk

A vulnerability is a weakness that could be used to compromise confidentiality, integrity or availability. Vulnerabilities may arise from coding errors, weak configurations, unsupported software, poor physical protection, inadequate procedures or human factors.

An exploit is a technique, code, tool or action that takes advantage of a vulnerability. The vulnerability is the weakness; the exploit is the means of using it. A vulnerability can exist even when no public exploit is known.

A zero-day vulnerability is a vulnerability that is unknown to the party responsible for fixing or defending against it, or for which no effective patch was available at the relevant time. The term is used in varying ways, so professional reports should explain the specific condition.

Risk is the possibility that a threat will exploit a vulnerability and cause harm. In basic practice, risk is analysed by considering likelihood and impact:

Likelihood expresses how probable a harmful event is within a defined period, while impact expresses the severity of its consequences. This is a conceptual model rather than a universal measurement law. Organisations may use qualitative categories such as low, medium and high, or quantitative methods based on evidence and assumptions. The formula does not imply that risk can always be calculated precisely.

For example, an internet-facing server with an unpatched critical vulnerability may have high likelihood of attack and high impact if it hosts sensitive customer data. A similar vulnerability on an isolated laboratory system may have lower exposure and therefore a different risk, although its impact could still be serious.

Risk appetite is the level and type of risk an organisation is willing to accept in pursuit of its objectives. Risk tolerance describes acceptable variation around objectives or risk criteria. These are governance decisions, not merely technical measurements.

Controls and Defence in Depth

A security control is a measure that modifies risk. Controls may be technical, administrative, physical or procedural. Examples include multifactor authentication, network segmentation, security policies, staff training, locks, backups, logging and incident-response plans.

Controls can also be classified by purpose:

These categories can overlap. A web application firewall may prevent some attacks and generate detection logs. A backup is primarily a recovery control, but it can reduce the impact of ransomware.

Defence in depth means using multiple, independent or partially independent layers of protection. For example, a sensitive application may be protected by secure coding, authentication, least privilege, network segmentation, endpoint protection, logging, backups and trained staff. Defence in depth is valuable because no single control is perfect and controls can fail in different ways.

Important control principles include:

• Least privilege: grant only the access needed for an authorised task.
• Separation of duties: divide sensitive responsibilities so one person cannot complete an abusive process alone.
• Secure defaults: begin with the safer configuration rather than requiring users to enable protection.
• Fail safely: when a component fails, avoid creating uncontrolled access or unsafe conditions.
• Accountability: maintain records that associate actions with responsible identities.
• Usability: controls should be practical enough that users can follow them consistently.

The Confidentiality–Integrity–Availability Triad

The confidentiality–integrity–availability, or CIA, triad is a foundational model for describing security objectives.

Confidentiality

Confidentiality means preventing unauthorised disclosure of information. Encryption, access control, data minimisation, secure disposal and privacy-preserving design can support confidentiality. A confidentiality failure occurs when an unauthorised person views, obtains or infers protected information.

Integrity

Integrity means maintaining the accuracy, completeness and trustworthiness of information and systems. Access controls, hashing, digital signatures, change management, input validation and audit trails support integrity. Integrity is compromised when data is altered, deleted, reordered or fabricated without authorisation.

Availability

Availability means that authorised users can access information and services when required. Redundancy, capacity planning, patching, backups, disaster recovery, resilience engineering and denial-of-service protection support availability.

The triad is not a complete description of every security objective. Authentication, accountability, authenticity, non-repudiation and safety may be important additional properties. Nevertheless, the CIA triad provides a common starting point for analysing protection requirements.

Figure: The CIA triad and its three principal security objectives.

The same incident can affect more than one objective. Ransomware commonly harms availability by denying access, but it may also threaten confidentiality if data is stolen and integrity if files are modified. A fraudulent transaction may primarily violate integrity while also causing financial and reputational impact.

Related Disciplines: Security, Privacy, Safety and Resilience

The following terms overlap but should not be treated as synonyms.

Information security is broader than cybersecurity because it includes paper records, verbal information and physical documents. Cybersecurity focuses on cyber-enabled systems and threats, although its effects may be physical.

Privacy is not simply confidentiality. Confidential information can be processed unfairly, excessively or without valid purpose. Conversely, privacy protections may involve transparency, consent, access rights, deletion, purpose limitation and data minimisation.

Safety and security can conflict. A safety system may need rapid access during an emergency, while security controls may restrict access. In industrial and medical environments, design must consider both malicious attacks and accidental failures.

Resilience extends beyond prevention. It recognises that incidents may occur despite controls and asks whether essential functions can continue and recover. Resilience includes preparation, response, recovery, learning and adaptation.

Authentication, Authorisation and Accountability

Identification is claiming an identity, such as entering a username. Authentication is verifying that claim, using something the user knows, has or is. Passwords are knowledge factors; hardware security keys and phones may be possession factors; biometric characteristics are inherence factors.

Authorisation determines what an authenticated identity may do. Authentication answers “Who are you?”; authorisation answers “What are you permitted to access or change?” Confusing these concepts can lead to excessive permissions.

Accounting or accountability records actions so that activity can be reviewed and attributed. Logs should be protected from unauthorised alteration, synchronised sufficiently for investigation and retained according to business and legal requirements.

Multifactor authentication uses two or more different factor categories. Two passwords are generally two instances of the same category, not multifactor authentication.

Applied Case: A Community Health Clinic

This illustrative case demonstrates how foundational terminology supports practical analysis.

Background

A community health clinic uses a cloud appointment system, electronic patient records, internet-connected diagnostic equipment and email communication. Staff work on desktop computers and occasionally use tablets at outreach events.

Problem

An employee receives an apparently urgent email from a supplier and enters credentials into a fraudulent website. The attacker uses the credentials to access the clinic’s email account. The account contains appointment information and links to cloud services. The attacker forwards selected messages externally and creates a mailbox rule that hides security notifications.

Analysis

The clinic’s patient records, email account, cloud services and diagnostic equipment are information assets. The phishing message is an attack vector. The stolen password is a compromised credential. The fraudulent website is part of the attack infrastructure. The mailbox rule is an unauthorised configuration change and may be an indicator of compromise.

Confidentiality is threatened because patient-related information may be disclosed. Integrity is threatened because messages and account settings may be altered. Availability could be affected if the attacker changes passwords or disrupts appointment communications. The attack surface includes email, cloud authentication, staff behaviour and connected devices.

The incident is not merely a “virus problem”; there is no evidence that malware was required. It is an account-compromise incident involving social engineering and inadequate identity protection.

Approach and Solution

The clinic should first preserve evidence, disable malicious sessions and mailbox rules, reset credentials through a trusted process, revoke active tokens and assess access to connected services. Multifactor authentication should be enabled, preferably with phishing-resistant methods for privileged and high-value accounts.

The clinic should then review sign-in logs, forwarding rules, access history and cloud audit records; identify affected information; notify appropriate management and regulators where required; and communicate accurately with affected individuals. It should avoid deleting evidence before investigation.

Longer-term controls include secure email filtering, staff training based on realistic scenarios, conditional access, least privilege, supplier verification procedures, tested backups, incident-response exercises and periodic review of third-party access.

Outcome

Assume the investigation finds that the attacker viewed appointment details but did not access the clinical database. The clinic can limit the scope of notification to confirmed or reasonably suspected exposure, subject to applicable law and professional advice. It should document uncertainty rather than claiming that no information was accessed merely because no download was proven.

Learning Points

The case shows why controls must address people, processes and technology together. Password strength alone was insufficient. It also demonstrates the distinction between an event, an incident and a breach, and shows that confidentiality, integrity and availability can be affected by one compromised account.

Governance, Ethics and Professional Practice

Security decisions involve rights, responsibilities and trade-offs. Practitioners should collect only information necessary for a legitimate purpose, restrict access, protect evidence and avoid unnecessary surveillance. Security testing must have explicit authorisation, defined scope and safe handling of discovered data. Accessing a system without permission is not made ethical merely because the intention is educational.

Organisations should align security practices with applicable legislation, contractual obligations, sector requirements and recognised frameworks. Requirements differ by jurisdiction, so terminology and reporting deadlines must be verified rather than assumed. Privacy impact assessments, records of processing, retention schedules and data-subject rights may be relevant when personal information is involved.

Artificial intelligence can assist with alert triage, anomaly detection, secure-code review and summarising logs. However, AI systems may produce false positives, false negatives, insecure code or expose sensitive prompts and training data. Human review, access controls, data governance, testing and documented accountability remain necessary.

Challenges and Limitations of Foundational Models

The CIA triad is powerful but simplified. It does not by itself describe safety, privacy, authenticity or resilience. Risk expressed as likelihood multiplied by impact can create false precision when evidence is weak. Risk ratings may also reflect organisational bias or omit cascading effects through suppliers and society.

Attack-surface inventories become outdated as cloud resources, software dependencies and connected devices change. Security controls can introduce usability problems, operational costs and new failure modes. Excessive controls may encourage workarounds, while insufficient controls may leave critical assets exposed.

No organisation can eliminate all risk. Professional security therefore requires prioritisation, continuous monitoring, transparent acceptance of residual risk and learning from incidents. The objective is not perfect prevention but informed, proportionate and sustainable protection.

Best-Practice Foundation

A diploma-level practitioner should develop the following habits:

1. Identify assets, owners, dependencies and business requirements.
2. Classify information and apply handling rules.
3. Maintain an accurate inventory of systems, accounts and services.
4. Reduce unnecessary attack surface and remove unsupported components.
5. Apply least privilege, secure defaults and multifactor authentication.
6. Patch and securely configure systems according to risk.
7. Protect logs, backups and recovery procedures; test them regularly.
8. Monitor for suspicious events and define escalation criteria.
9. Exercise incident-response and business-continuity plans.
10. Document assumptions, decisions, exceptions and residual risk.
11. Respect privacy, authorisation boundaries and professional ethics.
12. Review controls after technological, organisational or threat changes.

Chapter Summary

Cybersecurity protects digital systems and activities, while information security covers information in both digital and non-digital forms. Information assets include data, devices, services, credentials, applications and supporting dependencies. Cyberspace is a socio-technical ecosystem involving people, processes, technology and data.

Threats are potential causes of harm, vulnerabilities are weaknesses, exploits are methods of using weaknesses, and attack vectors are paths to a target. Risk describes the possibility and consequence of harm; controls modify that risk. Preventive, detective, corrective, deterrent, compensating and recovery controls are commonly combined through defence in depth.

The CIA triad describes confidentiality, integrity and availability. Authentication verifies identity, authorisation determines permitted actions and accountability records activity. Cybersecurity, information security, privacy, safety and resilience are related but distinct disciplines. Sound practice requires governance, ethical conduct, continuous assessment, practical controls and the ability to recover when prevention fails.

Key Terms

Asset: Something valuable that requires protection.

Attack surface: All points through which a system may be attacked or influenced.

Attack vector: The path or method used to reach a target.

Authentication: Verification of a claimed identity.

Authorisation: Determination of what an authenticated identity may do.

Availability: Accessibility of information or services to authorised users when required.

Breach: Unauthorised access, disclosure, acquisition or loss of protected information.

Confidentiality: Protection against unauthorised disclosure.

Control: A measure that modifies security risk.

Cybersecurity: Protection of digital systems, networks, services and activities from cyber threats.

Exploit: A technique, tool or action that takes advantage of a vulnerability.

Incident: An event or events that compromise or potentially compromise security.

Integrity: Accuracy, completeness and trustworthiness of information and systems.

Information asset: Information or a resource that stores, processes, transmits or supports information.

Privacy: Appropriate treatment and protection of information relating to identifiable people.

Resilience: Capacity to prepare for, withstand, recover from and adapt to disruption.

Risk: The possibility that a threat will exploit a vulnerability and cause harm.

Threat: A potential cause of harm to an asset or organisation.

Vulnerability: A weakness that could be exploited.

Zero-day vulnerability: A vulnerability unknown to defenders or lacking an effective fix at the relevant time.

Review Questions

Short Answer Questions

1. What is an information asset? Give two examples.
2. Distinguish a vulnerability from an exploit.
3. Define confidentiality, integrity and availability.
4. What is the difference between authentication and authorisation?
5. Why is information security broader than cybersecurity?

Long Answer Questions

1. Explain how people, processes, technology and data interact within cyberspace.
2. Describe defence in depth and explain why a single security control is insufficient.
3. Compare preventive, detective, corrective and recovery controls using examples.
4. Explain the differences among privacy, safety and resilience.
5. Discuss the strengths and limitations of using likelihood and impact to analyse risk.

Analytical / Application Questions

1. A university’s student portal is unavailable after a denial-of-service attack, but no evidence suggests data was viewed or altered. Identify the principal CIA objective affected, the likely attack vector, and three appropriate controls.
2. An employee can approve suppliers, create supplier accounts and authorise payments. Analyse the security weaknesses and recommend controls based on least privilege and separation of duties.
3. A hospital uses an AI tool to summarise patient records. Analyse confidentiality, integrity, privacy, safety and resilience concerns, and propose a proportionate control set.

Multiple Choice Questions with Answers

Question 1

Which statement best defines a vulnerability?

A. A method used to attack a system

B. A weakness that could be exploited

C. A record of a completed security incident

D. A control that restores a system

Correct Answer: B. A weakness that could be exploited

Question 2

A digital signature primarily supports which security property?

A. Integrity and authenticity

B. Availability only

C. Physical safety only

D. Data minimisation

Correct Answer: A. Integrity and authenticity

Question 3

Which example is a detective control?

A. A firewall blocking an unauthorised port

B. A backup restoring deleted files

C. An alert generated by an intrusion detection system

D. A policy warning employees about misconduct

Correct Answer: C. An alert generated by an intrusion detection system

Question 4

What does authorisation determine?

A. Whether a claimed identity is genuine

B. What an authenticated identity is permitted to do

C. Whether data has been encrypted

D. Whether a service is available

Correct Answer: B. What an authenticated identity is permitted to do

Question 5

A phishing email that leads a user to a fraudulent login page is best described as which of the following?

A. An attack vector

B. A recovery control

C. A privacy right

D. A backup dependency

Correct Answer: A. An attack vector

Question 6

Which statement correctly distinguishes privacy from confidentiality?

A. Privacy concerns only passwords, while confidentiality concerns only safety

B. Privacy concerns appropriate handling of personal information, while confidentiality concerns unauthorised disclosure

C. Privacy and confidentiality are always identical

D. Confidentiality applies only to paper records

Correct Answer: B. Privacy concerns appropriate handling of personal information, while confidentiality concerns unauthorised disclosure

Question 7

An unauthorised alteration to a payroll record primarily violates which CIA objective?

A. Confidentiality

B. Integrity

C. Availability

D. Resilience

Correct Answer: B. Integrity

Question 8

Which practice most directly applies the principle of least privilege?

A. Giving every employee administrator access

B. Allowing an employee only the permissions required for assigned duties

C. Disabling all audit logging

D. Using the same account for all staff

Correct Answer: B. Allowing an employee only the permissions required for assigned duties

Question 9

Why are two passwords generally not considered multifactor authentication?

A. Passwords cannot be changed

B. Both passwords belong to the same factor category: something known

C. Passwords always provide availability

D. Multifactor authentication requires three factors

Correct Answer: B. Both passwords belong to the same factor category: something known

Question 10

Which statement best describes resilience?

A. The guarantee that no incident will occur

B. The ability to prepare for, withstand, recover from and adapt to disruption

C. The process of hiding all information from users

D. The replacement of all preventive controls with backups

Correct Answer: B. The ability to prepare for, withstand, recover from and adapt to disruption