Study guide: Cybersecurity Fundamentals and Controls

📋 Course Outline

1. Cybersecurity Purpose and Core Concepts
2. The CIA Triad
3. Threats, Vulnerabilities, and Risk
4. Malware and Cyberattacks
5. Identity and Access Control
6. Security Controls and Recovery
7. Data Protection and Privacy

📖 1. Cybersecurity Purpose and Core Concepts

🔑 Key Concepts & Definitions

• Cybersecurity: Protection of systems, networks, and information from unauthorized access, harm, loss, or exposure.
• Security control: A measure used to protect systems, information, or users.

📖 2. The CIA Triad

🔑 Key Concepts & Definitions

• Confidentiality: Protection of information from unauthorized access.
• Integrity: Integrity ensures that data remains accurate and unchanged.
• Availability: The accessibility of systems and information when needed.

📝 Essential Points

• The CIA Triad consists of:
  • Confidentiality
  • Integrity
  • Availability

💡 Memory Hook

CIA names the three protection goals: confidentiality, integrity, availability.

📖 3. Threats, Vulnerabilities, and Risk

🔑 Key Concepts & Definitions

• Threat: A potential danger that could cause harm.
• Vulnerability: A weakness in a system, software, process, or user that a threat or attacker can exploit.
• Risk: Risk is the possibility of harm arising from cybersecurity threats and vulnerabilities.

📝 Essential Points

• Examples of vulnerabilities include:

  • Outdated software
  • Weak passwords
  • User accounts with more permissions than needed

• Risk mitigation means taking steps to reduce the risk or impact of a data security incident.

💡 Memory Hook

A threat exploits a vulnerability, creating risk of harm.

📖 4. Malware and Cyberattacks

🔑 Key Concepts & Definitions

• Malware: Malicious software designed to harm a computer or system.
• Ransomware: Malware that locks or encrypts files and demands payment.
• Phishing: A fraudulent attack using fake messages, websites, or communications to trick people into revealing sensitive information or taking an unsafe action.
• Worm: Malicious software that can spread automatically from one computer to another.
• Spyware: Malware that secretly collects information about a user's activities.
• Social engineering: An attack that tricks a person into revealing confidential information or taking an unsafe action.
• Denial-of-service attack: An attack that attempts to make a service unavailable, including by sending a large amount of traffic to a website.

📝 Essential Points

• Other named malware types are viruses, adware, and Trojans; a Trojan appears to be legitimate software, while adware displays unwanted advertisements.

• Named cyberattacks include:

  • Brute-force attacks
  • Man-in-the-middle attacks
  • Denial-of-service (DoS) attacks
  • Distributed denial-of-service (DDoS) attacks
  • Eavesdropping

📖 5. Identity and Access Control

🔑 Key Concepts & Definitions

• Authentication: Verification of a user's identity, such as when the user enters a password or uses a fingerprint to log in.
• Authorization: Determination of what an authenticated user is allowed to access or do.
• RBAC: Role-Based Access Control (RBAC) gives users access based on their job role.
• ABAC: Attribute-Based Access Control (ABAC) can use a user's location when deciding whether to allow access.

📝 Essential Points

📌 The principle of least privilege gives a user only the permissions needed to complete their work or task.

💡 Memory Hook

Authentication proves who you are; authorization decides what you may access.

📖 6. Security Controls and Recovery

🔑 Key Concepts & Definitions

• Backup: An extra copy of important data that can help restore information after data loss, system failure, or ransomware.

📝 Essential Points

• Security controls are classified by function as preventive, detective, or corrective, and by type as administrative, technical, or physical.

• A firewall is a technical control that can help protect a network from unauthorized traffic, and a security camera is a physical security control.

📖 7. Data Protection and Privacy

🔑 Key Concepts & Definitions

• Data protection: Data protection helps prevent unauthorized access, theft, loss, alteration, and exposure of personal and sensitive information.
• Data privacy: The ways personal information is collected, used, stored, shared, and protected.
• Data breach: Unauthorized access to or exposure of protected data.

📝 Essential Points

• Passwords and financial information are examples of sensitive information.