Cybersecurity is the practice of protecting systems, networks, devices, and data from unauthorized access, attack, or disruption. At the heart of the discipline lies the CIA triad: confidentiality, ensuring information is accessible only to authorized parties; integrity, ensuring data has not been altered or destroyed in an unauthorized manner; and availability, ensuring authorized users can access information and resources when needed. A breach of confidentiality means unauthorized parties accessed the data, as in a data leak. A breach of integrity means the data was altered or tampered with, even if it was never exposed, such as an attacker modifying financial records. Availability is considered equally important because a system is useless if legitimate users cannot reach it; DDoS attacks, ransomware, and hardware failures all target availability and can cause significant financial and operational damage.
Guiding principles shape how organizations structure their defenses. The principle of least privilege grants users and systems only the minimum access permissions required to perform their tasks, limiting the damage from compromised accounts, insider threats, and malware. Defense in depth layers independent controls such as firewalls, encryption, access controls, monitoring, and training so that no single point of failure compromises the entire system. The zero trust model takes this further by eliminating implicit trust based on network location and requiring every request to be authenticated and authorized; Google's BeyondCorp is a well-known implementation. Related ideas include secure by design (building security in from the start), secure by default (shipping with security enabled), and hardening, which reduces attack surface by removing unnecessary services and applying secure defaults.
Risk itself is the product of the likelihood that a threat exploits a vulnerability multiplied by the impact if it does. Risk management identifies, assesses, treats, and monitors that risk through four treatment options: avoid, transfer, mitigate, or accept. After controls are applied, any remaining risk is called residual risk. Concepts like fail-secure (failure denies access, the default for security) versus fail-open (failure allows access, used in safety-critical systems) and the rejection of security through obscurity, which relies on secrecy of design rather than solid controls, are also important foundations. A security policy states management intent, security standards supply the mandatory rules, and baselines define the minimum controls applied to a category of systems. The simplest habit to remember is to assume breach, minimize blast radius, monitor everything, patch quickly, and train people.