Cybersecurity Fundamentals
Explore the principles, terminology and practices that underpin cybersecurity. Learn how to identify risks, understand security controls and protect digital assets.
Learning objectives
By the end of this module, you should be able to explain fundamental security principles, distinguish common security terms and perform a basic risk assessment.
01. What is cybersecurity?
Protecting digital systems and information
Cybersecurity is the practice of protecting computers, networks, applications and information against unauthorised access, disruption, alteration or destruction.
It involves people, processes and technology. Strong cybersecurity is not achieved by installing one security product. It requires multiple safeguards, good decisions and continuous monitoring.
A school protects student records by restricting access, using strong authentication, maintaining backups and training staff to recognise phishing.
02. The CIA triad
The CIA triad is a foundational model used to describe three important goals of information security.
Confidentiality
Information should only be accessible to people and systems that are authorised to view it.
Student records are protected with access permissions so unauthorised people cannot read private information.
Integrity
Information should remain accurate and protected against unauthorised changes.
Only authorised staff can update examination results, and changes are recorded for review.
Availability
Systems and information should be accessible when authorised users need them.
Regular backups and recovery plans help a school restore access after a system failure.
03. Essential security terminology
Understanding these terms helps security professionals describe problems accurately and decide how to address them.
Asset
Something valuable that needs protection, such as a laptop, customer database or network.
Threat
A potential cause of harm, such as ransomware, a malicious insider or accidental data loss.
Vulnerability
A weakness that could be exploited, such as outdated software or weak access controls.
Risk
The possibility and potential impact of a threat exploiting a vulnerability.
Security control
A safeguard that reduces risk, such as encryption, backups or multi-factor authentication.
Attack surface
The points where a system could potentially be accessed or attacked.
04. Common security threats
Organisations face different kinds of threats. Each threat can affect confidentiality, integrity or availability.
Phishing
Deceptive messages that attempt to steal credentials, financial information or other data.
Malware
Malicious software that can damage systems, disrupt operations or expose information.
Insider threats
Security risks caused by people with legitimate access, whether through malicious actions or mistakes.
Weak authentication
Poor passwords or missing additional verification can make accounts easier to compromise.
Denial of service
Attacks that overwhelm a service and prevent legitimate users from accessing it.
Misconfiguration
Incorrect system settings that may expose services or information unnecessarily.
05. Defence in depth
Defence in depth uses multiple complementary security layers. If one control fails, other controls can still reduce the likelihood or impact of an incident.
Think in layers, not single solutions
Locks, secure rooms, device protection and controlled facility access.
Unique accounts, least privilege and multi-factor authentication.
Firewalls, endpoint protection, network segmentation and secure configurations.
Encryption, backups, access restrictions and appropriate retention policies.
Reviewing security events, reporting incidents and following recovery procedures.
Practical Lab 01 — Security Risk Assessment
SCENARIO-BASED INVESTIGATION · BEGINNER LEVEL
Case file: Greenfield Training Centre
Greenfield is a small training centre that stores student records on an office laptop. Staff use the same wireless network for administrative work and guest internet access.
- Asset: Laptop containing student records.
- Finding 01: The router still uses its default administrator password.
- Finding 02: Software updates have been delayed.
- Finding 03: Guest devices share the staff network.
- Finding 04: The laptop has no recent verified backup.
Investigation 1 of 3: Which asset needs protection?
Investigation 2 of 3: Which finding represents a vulnerability?
Investigation 3 of 3: Which action is the strongest immediate improvement to network access control?
Professional takeaway
Good security begins with identifying valuable assets, understanding threats and vulnerabilities, assessing risk and selecting suitable controls. Security is an ongoing process, not a one-time installation.
Module 01 — Knowledge Assessment
Five questions · One point per correct answer