Cybersecurity Fundamentals

The material is well suited for beginners, students taking their first security course, IT professionals who want to strengthen their foundational knowledge, or anyone curious about how the digital world stays safe. Even if you have some technical background, the cards are a great way to make sure your understanding of key ideas, like the difference between authentication and authorization or between symmetric and asymmetric encryption, is precise and confident rather than just vaguely familiar.

To get the most out of studying, try to connect each concept to the others rather than memorizing them in isolation. For example, thinking about how phishing relates to authentication, or how TLS/SSL relies on both encryption concepts, will help the knowledge stick. Spacing your review sessions over several days is far more effective than cramming everything at once, since many of these ideas build on each other and benefit from repeated exposure. Take your time with each card, and you will find that the picture of how cybersecurity works as a whole becomes much clearer.

Cybersecurity is the practice of protecting systems, networks, devices, and data from unauthorized access, attack, or disruption. At the heart of the discipline lies the CIA triad: confidentiality, ensuring information is accessible only to authorized parties; integrity, ensuring data has not been altered or destroyed in an unauthorized manner; and availability, ensuring authorized users can access information and resources when needed. A breach of confidentiality means unauthorized parties accessed the data, as in a data leak. A breach of integrity means the data was altered or tampered with, even if it was never exposed, such as an attacker modifying financial records. Availability is considered equally important because a system is useless if legitimate users cannot reach it; DDoS attacks, ransomware, and hardware failures all target availability and can cause significant financial and operational damage.

Guiding principles shape how organizations structure their defenses. The principle of least privilege grants users and systems only the minimum access permissions required to perform their tasks, limiting the damage from compromised accounts, insider threats, and malware. Defense in depth layers independent controls such as firewalls, encryption, access controls, monitoring, and training so that no single point of failure compromises the entire system. The zero trust model takes this further by eliminating implicit trust based on network location and requiring every request to be authenticated and authorized; Google's BeyondCorp is a well-known implementation. Related ideas include secure by design (building security in from the start), secure by default (shipping with security enabled), and hardening, which reduces attack surface by removing unnecessary services and applying secure defaults.

Risk itself is the product of the likelihood that a threat exploits a vulnerability multiplied by the impact if it does. Risk management identifies, assesses, treats, and monitors that risk through four treatment options: avoid, transfer, mitigate, or accept. After controls are applied, any remaining risk is called residual risk. Concepts like fail-secure (failure denies access, the default for security) versus fail-open (failure allows access, used in safety-critical systems) and the rejection of security through obscurity, which relies on secrecy of design rather than solid controls, are also important foundations. A security policy states management intent, security standards supply the mandatory rules, and baselines define the minimum controls applied to a category of systems. The simplest habit to remember is to assume breach, minimize blast radius, monitor everything, patch quickly, and train people.

Controlling who can do what rests on the AAA framework: authentication, authorization, and accounting. Authentication verifies a user's identity, typically with credentials, tokens, or biometrics. Authorization determines what an authenticated user is allowed to do. Accounting, or audit logging, records who did what and when, supporting investigation and compliance. Identification claims an identity ("I am Alice") while authentication proves it. Strong authentication is critical because accounts are the gateway to nearly every other control, and a single weak password can unravel an entire security posture.

Multi-factor authentication (MFA) raises the bar by requiring two or more independent verification factors drawn from different categories: something you know, such as a password; something you have, such as a phone or hardware token; and something you are, such as biometrics. Even if one factor is compromised, an attacker still cannot access the account without the others. Two-factor authentication (2FA) is the specific case of MFA using exactly two factors. Modern passwordless standards build on public-key cryptography: passkeys are device-bound, phishing-resistant credentials with no shared secret; WebAuthn is the W3C standard that underpins them; and FIDO2 combines WebAuthn with CTAP. Time-based one-time passwords (TOTP, RFC 6238) generate 6-digit codes from authenticator apps, while counter-based HOTP is less common. Federated identity and single sign-on (SSO) extend this further: SAML is an XML-based SSO standard, OAuth 2.0 is an authorization framework that lets apps obtain limited access without sharing passwords, and OpenID Connect is an identity layer on top of OAuth 2.0 that adds authentication and ID tokens. JSON Web Tokens (JWT) are a compact, URL-safe token format with a Header.Payload.Signature structure of three base64url-encoded parts used throughout these systems.

Once identity is established, access models determine permissions. Role-Based Access Control (RBAC) assigns permissions to roles and assigns users to those roles, simplifying administration. Attribute-Based Access Control (ABAC) makes decisions based on attributes of the user, resource, action, and environment, allowing fine-grained, context-aware policy enforcement. Strong passwords are long, unique, and unpredictable; length matters more than complexity because each additional character exponentially increases the number of combinations an attacker must try. Users should never reuse passwords because a single breached site enables credential stuffing, where stolen username/password combinations are automatically tried on thousands of other services. A password manager generates and stores unique strong passwords for every account, encrypted behind one master password, eliminating reuse and the need to memorize complex strings. Sessions represent server-side state for a logged-in user, referenced by a session ID in a cookie; defenses against session fixation (rotate the session ID on login) and session hijacking (protect the session ID with the Secure and HttpOnly attributes) round out identity hygiene.

Cryptography is the mathematical backbone of confidentiality, integrity, and authentication. Symmetric encryption uses a single shared key for both encryption and decryption, making it fast but raising the challenge of secure key distribution. The Advanced Encryption Standard (AES) is the dominant symmetric block cipher, standardized by NIST since 2001 with key sizes of 128, 192, or 256 bits. Asymmetric encryption uses a public/private key pair: the public key encrypts and the private key decrypts, or vice versa for signing. This solves the key distribution problem but is computationally slower. RSA is the most widely deployed asymmetric cipher, based on the difficulty of factoring large primes, with common key sizes of 2048, 3072, and 4096 bits. Elliptic Curve Cryptography (ECC) provides equivalent security with shorter keys, making it attractive for constrained environments.

Hashing is a one-way function that converts data into a fixed-length digest that cannot be reversed to recover the original input. SHA-256 is part of the SHA-2 family and produces a 256-bit output widely used for integrity verification. Older hashes such as MD5 and SHA-1 are deprecated for security purposes because collisions, situations where two different inputs produce the same hash output, have been demonstrated, undermining their integrity guarantees. Hashing is not encryption because there is no decryption key; instead, hashing verifies integrity and supports password storage. To resist rainbow tables, which are precomputed lookup tables of password hashes, modern systems add a unique random salt to each password before hashing. Dedicated password hash functions such as bcrypt, scrypt, and Argon2 are slow and memory-hard to resist GPU brute force; Argon2 is currently preferred because of its tunable memory and compute cost, side-channel resistance, and victory in the 2015 Password Hashing Competition. PBKDF2 is an older key derivation standard that applies a hash many times to slow brute force. A digital signature combines a hash with a private key to prove authenticity and integrity without revealing the secret key.

Public Key Infrastructure (PKI) is the system of certificate authorities, certificates, and policies that enables trusted public key distribution. A digital certificate is a signed document binding a public key to an identity, verified through the CA chain; the X.509 standard defines the format used in TLS, S/MIME, and code signing. A Certificate Authority (CA) is the trusted entity that issues certificates, and the root of trust is a CA whose certificate is pre-installed in operating system and browser trust stores. To obtain a certificate, an applicant submits a Certificate Signing Request (CSR). Revocation is handled through Certificate Revocation Lists (CRL) or the Online Certificate Status Protocol (OCSP), with OCSP stapling letting the server include a recent OCSP response in the TLS handshake to reduce client load. Transport Layer Security (TLS), the successor to SSL, encrypts data in transit, authenticates the server, and negotiates cipher suites during a TLS handshake. TLS 1.3 delivers a faster handshake (1-RTT, with 0-RTT for resumption) and removes legacy ciphers. Perfect forward secrecy, achieved through ephemeral key exchange like DHE or ECDHE, ensures that past sessions remain secure even if a long-term key is later compromised. HTTPS is HTTP over TLS, with HSTS and the HSTS preload list forcing browsers to use HTTPS even on first visit, and mutual TLS (mTLS) requiring both client and server to present certificates, common in zero-trust microservices. Certificate pinning, the public key pinning header (now deprecated in favor of Expect-CT and CAA records), and certificate transparency logs help detect or prevent misuse by compromised CAs.

Network defenses begin with the firewall, a device or software that filters traffic based on rules covering source, destination, port, and protocol. A stateless firewall inspects each packet independently against its rule set, while a stateful firewall tracks active connections and makes decisions based on the full context of the traffic session, so return traffic from an established connection is correctly permitted. A Web Application Firewall (WAF) is a specialized firewall that protects web applications from common attacks such as XSS and SQL injection. Reverse proxies sit in front of servers to terminate connections, enabling TLS offloading, caching, and WAF integration, while Content Delivery Networks (CDNs) distribute content across edge servers and provide DDoS protection. Network segmentation divides a network into zones to limit lateral movement after a breach, and microsegmentation applies that principle at the workload or process level, a cornerstone of zero trust.

Encryption secures traffic wherever it travels. Encryption at rest protects data stored on disk from physical theft; encryption in transit, typically via TLS, protects data moving between systems; encryption in use protects data during processing through confidential computing or homomorphic encryption. A Virtual Private Network (VPN) creates an encrypted tunnel between a user's device and a VPN server, protecting data from interception on untrusted networks and masking the user's IP address for privacy and to bypass geographic restrictions. Split tunneling routes some traffic through the tunnel while sending other traffic directly to the internet, trading security for performance. Zero Trust Network Access (ZTNA) is the modern successor to VPNs, granting per-application access based on identity and device posture rather than network location. Tamper-resistant hardware security modules (HSMs) store cryptographic keys and perform operations, validated under standards like FIPS 140 for federal use cases.

Detection and prevention systems sit on the wire to spot malicious activity. An Intrusion Detection System (IDS) monitors network traffic and alerts administrators about suspicious activity but does not block it. An Intrusion Prevention System (IPS) actively blocks detected threats in real time, sitting inline with traffic to intercept malicious packets. Modern deployments often combine the two. Endpoint Detection and Response (EDR) agents run on endpoints to detect threats, while Extended Detection and Response (XDR) extends that visibility across network and cloud telemetry. Security Operations Centers (SOCs) are the teams that monitor, detect, and respond to events, supported by Security Information and Event Management (SIEM) platforms that collect, correlate, and alert on logs, and Security Orchestration, Automation and Response (SOAR) platforms that automate SOC workflows. SIEM correlation rules identify suspicious patterns across multiple log sources, and SOAR playbooks codify automated responses to specific alert types. Bring Your Own Device (BYOD) introduces complexity because personal devices access corporate data; Mobile Device Management (MDM) centralizes policy enforcement across those devices.

Most modern attacks target applications, making secure software development a frontline concern. The OWASP Top 10 is a periodically updated list of the most critical web application security risks. In 2021, the leading category was A01: Broken Access Control, the most common serious vulnerability, often caused by trusting client-side checks. A02 was Cryptographic Failures, formerly known as Sensitive Data Exposure. Related access issues include Insecure Direct Object References (IDOR), where internal IDs are exposed without authorization checks, and privilege escalation, where an attacker gains higher permissions. Vertical privilege escalation elevates a standard user to admin, while horizontal escalation lets user A access user B's data at the same privilege level. Other critical web risks include Remote Code Execution (RCE), Server-Side Request Forgery (SSRF), CRLF injection that manipulates HTTP headers, XML External Entity (XXE) attacks that abuse XML parsers, path traversal using ../ sequences to escape directories, and open redirects used to funnel users into phishing sites.

Injection flaws remain a staple of web attacks. SQL injection inserts malicious SQL code into input fields that are passed directly to a database query without proper sanitization, exploiting improper input validation and allowing attackers to read, modify, or delete database contents. Prevention relies on parameterized queries or prepared statements, which use placeholders so values are bound separately and cannot be interpreted as SQL; user input must never be concatenated into queries. Cross-Site Scripting (XSS) injects malicious scripts into web pages viewed by other users. Stored XSS persists on the server, for example in a forum post, and affects every visitor; reflected XSS is embedded in a URL and executes only when a victim clicks the crafted link; DOM-based XSS executes in client-side JavaScript. Defenses include contextual output encoding, Content Security Policy (CSP) headers that restrict what resources a page can load, input validation, framework auto-escaping, and the HttpOnly cookie attribute that prevents JavaScript from accessing session cookies.

Cross-Site Request Forgery (CSRF) tricks a user's browser into making unwanted authenticated requests. Defenses include CSRF tokens, which are random tokens tied to the user session that must accompany state-changing requests and cannot be forged by attackers, the SameSite cookie attribute (Strict, Lax, or None) that controls whether cookies are sent on cross-site requests, double-submit patterns, custom request headers, and Origin header checks. The Secure attribute ensures cookies are sent only over HTTPS. Browsers enforce the Same-Origin Policy (SOP), restricting scripts from interacting across origins, while Cross-Origin Resource Sharing (CORS) is the server-controlled relaxation of SOP for legitimate cross-origin requests, signaled by headers such as Access-Control-Allow-Origin and Access-Control-Allow-Credentials. Browsers send an OPTIONS preflight before non-simple cross-origin requests. A rich set of security headers hardens the browser side: CSP restricts resource loading, HSTS enforces HTTPS, X-Frame-Options (now largely superseded by CSP frame-ancestors) prevents the page from being embedded in iframes to defeat clickjacking, X-Content-Type-Options: nosniff prevents MIME-sniffing attacks, Referrer-Policy limits referrer leakage, and Permissions-Policy controls which browser features a page may use. DevSecOps integrates security into DevOps through security as code and automated pipelines, supported by Static Application Security Testing (SAST) on source code, Dynamic Application Security Testing (DAST) on running apps, Interactive AST (IAST) that combines both, and Software Composition Analysis (SCA) that scans dependencies for known vulnerabilities. Data Loss Prevention (DLP) tools and policies prevent sensitive data from leaving the organization, and data classification schemes categorize data by sensitivity so appropriate protections can be applied.

Attackers rely on a wide arsenal of techniques, often chaining multiple weaknesses together. Phishing tricks users into revealing credentials or executing malicious actions through deceptive emails or pages. Spear phishing targets specific individuals with researched, personalized content, making it far more convincing. Whaling aims at executives, smishing delivers phishing via SMS, vishing uses voice calls, and Business Email Compromise (BEC) impersonates executives to authorize fraudulent wire transfers. A man-in-the-middle (MITM) attack secretly intercepts and potentially alters communication between two parties who believe they are communicating directly; TLS with valid certificate validation makes such interception extremely difficult, while certificate pinning trusts only specific certificates or public keys to defend against compromised CAs. DNS spoofing returns false DNS responses to redirect traffic, mitigated by DNSSEC, which adds cryptographic signatures to DNS records for integrity.

Malware, malicious software designed to damage systems, steal data, spy on activity, or disrupt operations, comes in many forms. Viruses attach to legitimate programs, worms self-replicate and spread without user interaction, and trojans disguise themselves as legitimate software. Rootkits stealthily hide their presence at the OS or firmware level, logic bombs activate on a trigger condition such as a date or event, and backdoors provide hidden access that bypasses normal authentication. Ransomware encrypts a victim's files and demands payment for the decryption key; security experts recommend not paying because payment does not guarantee recovery and funds criminal operations, instead isolating affected systems, restoring from backups, and reporting to authorities. Botnets, networks of compromised devices controlled by an attacker, are often used to launch Distributed Denial of Service (DDoS) attacks, which flood a target from many sources to exhaust resources, much harder to mitigate than a single-source DoS. Defenses against DDoS include anti-DDoS services such as Cloudflare and AWS Shield, rate limiting, scaling, and sinkhole routing.

Software supply chains have become prime targets. A supply chain attack compromises a software dependency or build pipeline to attack downstream users, as exemplified by the 2020 SolarWinds Orion breach that infiltrated thousands of government and corporate networks. Dependency confusion publishes a malicious package with the same name as an internal package, while typosquatting registers package names similar to popular ones, such as reqeusts versus requests, to trap users. A Software Bill of Materials (SBOM) lists the components and dependencies in a piece of software, enabling organizations to know what they are running. The secret sprawl problem arises when API keys, tokens, and passwords are scattered through code and config, becoming a common cause of breaches. Secret scanning, offered by GitHub, GitLab, and AWS, automatically detects secrets in repositories, while centralized secrets management services like HashiCorp Vault or AWS Secrets Manager store and control access to those credentials. Brute-force attacks systematically try many passwords or keys, dictionary attacks use a wordlist of likely passwords, and credential stuffing reuses leaked credentials from one site to log into another; defenses include MFA, rate limiting, breach detection services such as Have I Been Pwned, and unique passwords per site. Software updates patch known vulnerabilities that attackers actively exploit, making prompt patch management essential. Even well-designed systems can leak through indirect channels: side-channel attacks exploit information leaks such as timing or power consumption, with Spectre and Meltdown as famous CPU examples; timing attacks infer secrets from execution-time variation and are mitigated by constant-time algorithms.

Defenders think in terms of controls and their timing. Preventive controls stop incidents before they happen, detective controls find them when they occur, and corrective controls fix the aftermath. Security controls themselves may be technical, administrative, or physical. Threat modeling provides a structured analysis of what assets need protection, from whom, and how. Microsoft's STRIDE categorizes threats as Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. DREAD is a complementary scoring model weighing Damage, Reproducibility, Exploitability, Affected users, and Discoverability. Frameworks like the Lockheed Martin cyber kill chain describe attack stages from Reconnaissance through Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives, while MITRE ATT&CK catalogs adversary tactics, techniques, and procedures (TTPs) for threat modeling and detection engineering.

Vulnerability management is an ongoing discipline. Common Vulnerabilities and Exposures (CVE) provide unique identifiers for publicly known vulnerabilities, while the Common Vulnerability Scoring System (CVSS) rates severity on a 0-10 scale based on attack vector, complexity, and impact, and the Common Weakness Enumeration (CWE) categorizes software weakness types. A zero-day vulnerability is unknown to the vendor, meaning no patch exists when it is discovered or exploited, making it especially dangerous because defenders have zero days to prepare and traditional signature-based tools cannot detect it. Patch management is the process of identifying, testing, deploying, and verifying patches across systems, prioritizing internet-facing systems. Vulnerability scanning uses automated tools to find known weaknesses without exploiting them, while penetration testing involves authorized simulated attacks that actively exploit vulnerabilities to assess real-world impact and reveal how they can be chained. A red team exercise is a realistic adversary simulation that tests detection and response more broadly than a pentest, while a blue team is the defensive counterpart monitoring and protecting systems; a purple team combines both sides to improve attack and defense together.

The incident response lifecycle, defined in NIST SP 800-61, proceeds through Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. Preparation establishes plans and teams; identification detects the incident; containment limits the damage and prevents spread; eradication removes the threat; recovery restores systems to normal operation; and lessons learned reviews the incident to improve future response. Containment is especially critical because without rapid action an attacker could escalate privileges, exfiltrate more data, or compromise additional assets, dramatically increasing impact. A Security Operations Center (SOC) monitors, detects, and responds to events around the clock. SIEM platforms collect and correlate logs, SOAR platforms automate response, EDR and XDR provide endpoint and cross-domain telemetry, and threat intelligence supplies information about emerging threats. Indicators of Compromise (IOCs) are observable artifacts suggesting an intrusion, including file hashes, IP addresses, domains, and registry changes. A security incident is any event that threatens confidentiality, integrity, or availability and requires investigation or response. The security officer accountable for these programs is the Chief Information Security Officer (CISO), an executive who carries the responsibility for organizational security posture and risk treatment decisions.

Frameworks and standards give organizations a shared vocabulary and a roadmap for managing risk. The NIST Cybersecurity Framework (NIST CSF) is a voluntary framework with five core functions: Identify (understand risk), Protect (implement safeguards), Detect (discover events), Respond (take action), and Recover (restore capabilities). ISO 27001 is the international standard for Information Security Management Systems (ISMS), and certification means an organization has implemented a systematic ISMS that meets international standards for managing sensitive information, including regular risk assessments, security controls, and continuous improvement processes. SOC 2 is an AICPA audit framework that assesses controls around security, availability, confidentiality, processing integrity, and privacy. Together these frameworks translate abstract security principles into operational requirements.

Regulations add legally enforceable obligations. PCI DSS governs how organizations handle credit card data. HIPAA is the U.S. law protecting health information privacy and security. GDPR is the EU's General Data Protection Regulation, a privacy law with extraterritorial reach that applies to any organization handling EU residents' personal data. The federal validation standard for cryptographic modules is FIPS 140, required in federal use cases. Beyond the letter of these regulations, organizations also need operational discipline: data classification categorizes data as public, internal, confidential, or restricted so appropriate protections can be applied, while DLP tools and policies prevent sensitive data from leaving the organization. Secret scanning and secrets management reduce the secret sprawl that routinely causes breaches.

Risk sits at the heart of governance. Risk is the likelihood of a threat exploiting a vulnerability multiplied by the impact if it does, and risk management identifies, assesses, treats, and monitors that risk over time. The four risk treatment options are avoid, transfer, mitigate, and accept, with any remaining risk after controls called residual risk. The role of "trust but verify" pairs naturally with zero trust: initial confidence is established, but verification is required to confirm it is still valid. Security through obscurity, relying on the secrecy of design as the primary defense, is generally insufficient on its own and must be combined with real controls. Practical daily habits reinforce governance: pausing before trusting links, attachments, requests for credentials, or unusual urgency, recognizing that software updates patch known vulnerabilities actively exploited by attackers, and assuming that human factors are both the weakest link and a powerful defensive asset. A security control is a safeguard or countermeasure implementing policy; controls may be preventive, detective, or corrective, and they may be technical, administrative, or physical. The CISO is the executive responsible for the entire security program, and the simplest overarching principle is to assume breach, minimize blast radius, monitor everything, patch quickly, and train people.