Cybersecurity Fundamentals
CIA Triad, threat actors, common attack types, defence-in-depth, and how security teams operate.
Learning Objectives
- → Apply the CIA Triad to real security decisions
- → Classify threat actors by motivation and capability
- → Describe defence-in-depth and the principle of least privilege
- → Identify common attack categories: phishing, injection, MITM, DoS
The CIA Triad
Every security decision should be measured against three goals:
| Pillar | Definition | Example attack |
|---|---|---|
| Confidentiality | Data accessible only to authorised parties | Data breach, eavesdropping |
| Integrity | Data is accurate and unmodified | SQL injection altering records |
| Availability | Systems are accessible when needed | DDoS attack |
Some models add Non-Repudiation (you can't deny an action you took) and Authentication.
Threat Actors
| Actor | Motivation | Sophistication |
|---|---|---|
| Script kiddie | Fun, curiosity | Low |
| Hacktivist | Ideology, politics | Medium |
| Cybercriminal | Financial gain | Medium-High |
| Insider threat | Grievance, money | Varies |
| Nation-state (APT) | Espionage, sabotage | Very High |
Attack Surface
The attack surface is everything that can be attacked: open ports, web applications, employee email addresses, physical access points, third-party software.
Reduce it by:
- Disable unused services and ports
- Remove unused software (fewer dependencies)
- Apply least privilege
- Segment the network
Defence in Depth
No single control is perfect. Layer multiple defences so that if one fails, others still protect:
Perimeter (firewall) → Network (IDS/IPS) → Host (antivirus, EDR)
→ Application (WAF, secure coding) → Data (encryption, DLP)
→ People (security awareness training)
Risk = Likelihood × Impact
A vulnerability with high likelihood of exploitation and high impact = critical risk. Patch it immediately.
Low likelihood + low impact = accept the risk or mitigate later.
Every security control either protects Confidentiality, Integrity, or Availability — or trades one for another. The CIA Triad is your decision-making framework.
| Scenario | Violated Pillar | Correct Response |
|---|---|---|
| Ransomware encrypts all files | Availability (+ Integrity) | Offline backups, incident response, restore |
| Employee leaks customer PII | Confidentiality | DLP, access control review, encrypt at rest |
| Attacker modifies a financial record | Integrity | Audit logs, hashing, digital signatures |
| DDoS knocks down e-commerce site | Availability | CDN scrubbing, rate limiting, failover |
| SQL injection exposes user database | Confidentiality | Input validation, parameterised queries, WAF |
A DDoS attack that takes down a website violates which CIA pillar?
Digital signatures protect which pillar?
Not all attackers are the same. Knowing who might attack you determines what controls make sense. A nation-state and a script kiddie require very different defences.
| Threat Actor | Motivation | Capability | Example |
|---|---|---|---|
| Script Kiddie | Notoriety, boredom | Low — uses existing tools | Running Metasploit modules with no understanding |
| Cybercriminal | Financial gain | Medium-High | Ransomware gangs, phishing-as-a-service operators |
| Hacktivist | Political/social message | Medium | Anonymous DDoS of government sites |
| Insider Threat | Revenge, money, coercion | High (has access) | Sysadmin selling database to competitor |
| Nation-State (APT) | Espionage, sabotage | Very High | Stuxnet (Iran nuclear), SolarWinds supply chain |
Which threat actor type is motivated by financial gain and commonly uses ransomware?
What makes insider threats particularly dangerous?
Defence-in-depth means layering multiple security controls so that when one fails, others still protect you. No single control is perfect.
| Layer | Examples | What it stops |
|---|---|---|
| Perimeter | Firewall, DDoS scrubbing, DMZ | Blocks most unsolicited inbound traffic |
| Network | IDS/IPS, VPN, NAC, VLANs | Detects lateral movement, segments traffic |
| Endpoint | EDR, AV, patch management, disk encryption | Catches malware, protects stolen hardware |
| Application | WAF, input validation, SAST/DAST | Blocks SQLi, XSS, injection attacks |
| Data | Encryption at rest, DLP, backups | Limits impact of breach; enables recovery |
In defence-in-depth, what does the 'endpoint' layer include?
Zero Trust assumes:
Most attacks fall into a small number of categories. Recognising the category instantly tells you what family of defences applies.
🎣 Phishing / Social Engineering
Trick humans into credentials or access. Spear-phishing targets specific individuals. Vishing = voice phishing. Pretexting = fake scenario.
💉 Injection Attacks
SQL injection, command injection, XSS — attacker sends malicious data that gets executed. Most common web vulnerability category (OWASP #1).
🕵️ Man-in-the-Middle (MITM)
Attacker intercepts communication between two parties. ARP spoofing (LAN), evil twin WiFi, SSL stripping. Enables eavesdropping + modification.
💥 DoS / DDoS
Flood targets with traffic or requests to exhaust resources. DDoS uses botnets of thousands of machines. Amplification attacks (DNS/NTP) multiply traffic.
Spear phishing differs from regular phishing because:
Parameterised queries (prepared statements) prevent:
💪 Exercises & Challenges
Attack Surface Mapping
## Task: Map Your Own Attack Surface **Step 1 — Port scan your own system:** ```bash sudo nmap -sV localhost ``` **Step 2 — List listening services:** ```bash ss -tlnp # TCP listening ports ss -
CIA Classification
An attacker intercepts HTTPS traffic between a user and their bank by performing a MITM attack, reading account balances without modifying anything. Which CIA pillar is violated? Submit: `FLAG{CIA_pi