Cybersecurity is the practice of protecting systems, networks, and data from digital attacks, unauthorized access, and damage. At its heart sit three core principles often called the CIA triad. Confidentiality ensures that information is accessible only to authorized parties, integrity guarantees that data remains accurate and unaltered except by sanctioned changes, and availability ensures that systems and data are reachable when legitimate users need them. Together these properties define what defenders are trying to preserve, and they shape virtually every security decision made in an organization.
Complementing the CIA triad is the AAA framework of authentication, authorization, and accounting. Authentication verifies the identity of a user, device, or system, while authorization grants permission to access specific resources or perform specific actions. The familiar shorthand "authentication confirms who you are; authorization defines what you can do" captures the distinction. Accounting tracks and logs user actions to support audits and forensic investigations. Closely related is non-repudiation, the assurance that someone cannot later deny having performed an action, which is often achieved through cryptographic techniques such as digital signatures.
Security work also relies on a vocabulary of risk concepts. A threat is a potential cause of an unwanted incident that may harm a system, while a vulnerability is a weakness that a threat can exploit. Risk is the potential for loss when a threat successfully exploits a vulnerability, sometimes summarized by the equation risk equals threat times vulnerability times impact. An exploit is a piece of code or technique that takes advantage of a vulnerability. Around these concepts sit foundational principles: defense in depth layers multiple controls so that the failure of any one does not compromise the whole, the principle of least privilege grants users only the minimum permissions they need, and separation of duties splits critical functions across people to prevent fraud and abuse.