Cybersecurity Basics

Learning Objectives

  • Understand the fundamental principles of the CIA Triad.
  • Identify common cyber threats, including malware and social engineering.
  • Understand the basic concepts of cryptography, including symmetric and asymmetric encryption.
  • Distinguish between hashing and encryption and their respective use cases.
  • Recognize basic network defenses and common web vulnerabilities (OWASP).

An introduction to the fundamentals of cybersecurity, the CIA Triad, cryptography, hashing, and common web vulnerabilities (OWASP).

Cybersecurity

Cybersecurity is the comprehensive practice of protecting computer systems, networks, devices, and programs from digital attacks, unauthorized access, or damage. These cyberattacks are usually aimed at accessing, changing, or destroying sensitive information, extorting money, or disrupting normal business processes.

1. The Foundation: The CIA Triad

The CIA Triad is a model for discussing three security objectives: confidentiality, integrity, and availability. A system and its controls may need to address more than one objective, and the priorities depend on the information and service being protected.

The CIA Triad

  • Confidentiality: Ensuring that data is accessed only by authorized individuals. (e.g., Encrypting credit card numbers so hackers cannot read them; using passwords).
  • Integrity: Protecting information and resources against improper or unauthorized change. A checksum can detect corruption when compared with a trusted value, but an unauthenticated digest supplied alongside a file does not prove who published it or that nobody changed it; verify a trusted digest, digital signature, or message authentication code as appropriate.
  • Availability: Ensuring that data, network resources, and systems are consistently accessible to authorized users when they need them. (e.g., Using backup generators for server rooms; mitigating DDoS attacks).
The three CIA security objectives

The CIA Triad is a classification model, not a sequence. A single threat or control can affect multiple objectives; the impact depends on the system and context.

Three connected cards define confidentiality as controlling disclosure, integrity as guarding against improper change or destruction, and availability as timely and reliable access.

2. Common Cyber Threats and Malware

Understanding the types of attacks is critical to defending against them. Attack vectors target vulnerabilities in software, hardware, or human psychology.

Types of Malware and Threats

  • Virus and worm: Both are malware, but a virus attaches to a host program or file, while a worm is self-contained and can propagate between systems. Their effects depend on the code, permissions, and affected system.
  • Ransomware: Malware that encrypts files or otherwise blocks access to extort a victim. Some campaigns also steal data and threaten to disclose it; data theft is not required for ransomware.
  • Phishing (social engineering): A deceptive message or site impersonates a trusted person or organization to persuade someone to disclose information, grant access, or run malicious content.
  • DDoS (distributed denial of service): Traffic or requests from multiple sources consume network or service resources and degrade or prevent legitimate access. A botnet is one possible source; the service need not crash for availability to be affected.
Common threats differ in how they affect systems

The CIA impacts shown are common possibilities, not exclusive outcomes. A threat's actual effect depends on its behavior, the target, and the controls in place.

Four threat cards distinguish virus and worm propagation, ransomware extortion, phishing deception, and distributed denial-of-service resource exhaustion, with possible security impacts labeled.

3. Cryptography Fundamentals

Cryptography provides mathematical techniques for confidentiality, integrity, and authentication. Encryption can protect confidentiality when the keys are managed securely; signatures and authenticated-encryption modes can also provide integrity or authenticity properties.

Encryption Concepts

  • Plaintext: The original, easily readable message or data.
  • Ciphertext: The encrypted, mathematically scrambled, unreadable message.
  • Symmetric encryption (e.g., AES): Uses shared secret key material for encryption and decryption. Authenticated Encryption with Associated Data (AEAD) modes can protect confidentiality and detect changes to ciphertext. The communicating parties must establish and protect the key material.
  • Public-key cryptography: Uses related public and private keys for operations such as digital signatures, public-key encryption, or key agreement. These are different operations: a signature authenticates signed data, while key agreement helps parties establish shared secret material.
  • TLS 1.3: In a common certificate-authenticated handshake, ephemeral key agreement contributes to shared traffic keys, the certificate and handshake signature authenticate the server, and symmetric authenticated encryption protects application records. TLS 1.3 does not use RSA key transport; SSLv3 is prohibited and is not a modern HTTPS protocol.
TLS 1.3 separates server authentication from record encryption

This diagram groups dependencies in a common certificate-authenticated ephemeral key-agreement handshake; it is not a message timeline. HKDF derives distinct handshake and application traffic secrets, then traffic keys and IVs. Those keys protect encrypted handshake records such as CertificateVerify and Finished; application traffic keys protect application records. The client validates the server certificate chain and signature.

A TLS 1.3 dependency diagram shows ECDHE shared secret material feeding an HKDF key schedule that derives separate handshake and application traffic secrets, from which record keys and IVs are derived. Handshake record keys protect CertificateVerify and Finished; application keys protect records with AEAD. A certificate chain and CertificateVerify signature establish server identity.

3.1 A Historical Caesar Cipher

A Caesar cipher substitutes each letter by a fixed shift. With A = 0 and a shift of 3, ATTACK becomes DWWDFN; shifting back by 3 recovers the original text. The alphabet wraps after Z.

Historical Example Only

The Caesar cipher is a historical substitution cipher used here to demonstrate a simple reversible transformation. It is not suitable for protecting modern data.

4. Hashing vs. Encryption

Encryption is designed to be reversible by a party with the required key. A cryptographic hash maps an input to a fixed-length digest. Secure hash algorithms are designed to make recovering an input or finding certain collisions computationally infeasible, not mathematically impossible in every case.

Hashing Properties & Uses (Ensuring Integrity)

  1. A cryptographic hash produces a fixed-length digest; collisions are possible because different inputs can map to the same finite output, while secure designs make finding useful collisions computationally difficult.
  2. The same input to the same deterministic hash algorithm produces the same digest.
  3. The avalanche effect is a design goal: changing a small part of the input should change many output bits unpredictably, not guarantee that every output bit changes.

Password storage: Do not store plaintext passwords or use a fast general-purpose hash such as SHA-256 by itself. Store a unique salt and the result of a password-hashing function configured to make guesses expensive, such as Argon2id, scrypt, bcrypt, or an approved PBKDF2 configuration. At login, the verifier checks the candidate using the stored salt and parameters. A stolen password database remains sensitive because attackers may make offline guesses.

Encryption, hashes, and password verifiers serve different roles

A general cryptographic hash is not adequate password storage by itself. Password verifiers use a unique salt and a deliberately expensive password-hashing function; the salt and parameters are stored with the result and are not secret keys.

Three panels compare reversible encryption with a key, a fixed-length cryptographic digest, and a salted slow password-hashing verifier that is checked during login.

5. Network and Web Application Security

Organizations use a "Defense in Depth" strategy, layering multiple controls to protect their networks, while developers must protect their code against common web vulnerabilities documented by OWASP (Open Web Application Security Project).

Network Defenses

  • Firewall: A host or network control that permits or blocks traffic according to configured rules. Its coverage depends on placement, rule quality, and what traffic it can inspect.
  • MFA (Multi-Factor Authentication): Authentication that combines evidence from at least two different factor categories: something the user knows, has, or is. Two passwords are still one factor category; not all MFA methods provide the same resistance to phishing.

Common Web Vulnerabilities (OWASP)

  • SQL Injection (SQLi): Occurs when untrusted input changes the structure of a database query. Primary defense: use prepared statements with parameter binding; validate values for the application's rules as well.
  • Cross-Site Scripting (XSS): Occurs when untrusted data reaches a browser context where it is interpreted as executable content. Defense: use context-aware output encoding and safe APIs such as textContent; sanitize only when the application intentionally allows HTML.
  • Cross-Site Request Forgery (CSRF): Tricks a browser into sending an unwanted authenticated request to a site. Defenses can include anti-CSRF tokens and origin checks; appropriately configured SameSite cookies add defense in depth, but no one setting is universal for every application.
Match web vulnerabilities with controls for their context

The controls address different interpreters and browser behaviors; they are not interchangeable. Applications may need layered controls and framework-specific review.

Three rows match SQL injection with parameterized queries, cross-site scripting with context-aware output encoding and safe sinks, and cross-site request forgery with tokens and request-origin defenses.
Key Takeaways
  • The CIA Triad describes confidentiality, integrity, and availability; one event can affect several objectives.
  • Malware, phishing, ransomware, and DDoS differ in how they gain access or affect systems, and their impacts depend on context.
  • Symmetric cryptography protects data with shared secret keys; public-key operations can support authentication or key agreement.
  • TLS 1.3 commonly combines ephemeral key agreement, certificate-based authentication, and symmetric authenticated encryption.
  • Cryptographic hashes support integrity uses, while password storage needs a unique salt and a slow password-hashing function.
  • Firewalls and MFA are controls whose effectiveness depends on configuration and factor choice.
  • Parameterized queries, context-aware output handling, and CSRF defenses address different web attack surfaces.

References