Cybersecurity fundamentals
Cybersecurity protects three properties of information, known as the CIA triad:
To think like a security analyst, separate three words:
| Vulnerability | A weakness: an unpatched server, or the password `123456`. |
| Threat | Anything that could exploit the weakness: an attacker, malware, even a flood. |
| Risk | Likelihood of harm × its impact. This is where management decides where to spend on security. |
| Attack | What it does | Hits |
|---|---|---|
| Ransomware | Encrypts company files and demands payment to unlock them. | Availability |
| Phishing | A fake message tricks you into giving a password or opening a malicious file. | Confidentiality |
| DDoS | Thousands of devices flood a site with requests until it falls over. | Availability |
| Man-in-the-middle | The attacker listens to or alters traffic between you and the server, such as a fake public Wi-Fi. | Confidentiality, integrity |
| SQL injection | Typing SQL into a form field to read or change the database. | Confidentiality, integrity |
Watch outSQL injection links this track to the SQL track: if an app pastes user input straight into a query, someone could type
' OR '1'='1 and get in without a password. The fix: prepared statements that keep code and data apart.