Cybersecurity

Cybersecurity is not a single tool or product. It is a continuous risk-management discipline. Organizations identify what they need to protect, assess the threats and vulnerabilities affecting those assets, apply proportionate controls, and continuously monitor, respond to and recover from incidents.

Effective cybersecurity follows the principle of defense in depth: multiple independent layers of controls (preventive, detective and corrective) ensure that the failure of one safeguard does not result in a full compromise. Modern programs increasingly adopt a Zero Trust model, in which no user, device or network location is trusted by default and every access request is explicitly verified.

Core Principles: The CIA Triad

The foundation of cybersecurity is the CIA triad:

• Confidentiality ensures that information is accessible only to authorized parties, typically through access control and encryption.
• Integrity ensures that data and systems are accurate and have not been altered without authorization, using hashing, digital signatures and change control.
• Availability ensures that systems and data remain accessible to authorized users when needed, supported by redundancy, backups and DDoS protection.

Two further properties are often added: authenticity (verifying the identity of users and systems) and non-repudiation (ensuring an action cannot later be denied, usually through logging and digital signatures).

Key Domains of Cybersecurity

• Network security: protecting network infrastructure and traffic using firewalls, segmentation, IDS/IPS and secure remote access.
• Application security: building and maintaining software that resists attack through secure coding, threat modeling, code review, SAST/DAST and dependency management.
• Cloud security: securing workloads, identities and data in IaaS, PaaS and SaaS environments under the shared responsibility model.
• Endpoint security: protecting servers, workstations and mobile devices with hardening, patching and EDR solutions.
• Identity and Access Management (IAM): controlling who can access what through authentication, MFA, least privilege and privileged access management.
• Data security: classifying, encrypting, masking and controlling the lifecycle of sensitive data.
• Security operations: monitoring, detecting and responding to threats through a SOC, SIEM, threat intelligence and incident response.
• Governance, Risk and Compliance (GRC): aligning security with business objectives, legal requirements and industry standards.
• Operational technology (OT) security: protecting industrial control systems and critical infrastructure.

Common Cyber Threats

• Malware and ransomware: malicious software that disrupts systems, steals data or encrypts files for extortion.
• Phishing and social engineering: manipulating people into disclosing credentials or performing harmful actions.
• Credential attacks: credential stuffing, brute force and password spraying against authentication systems.
• Exploitation of vulnerabilities: abusing unpatched software or misconfigurations, often tracked as CVEs.
• Web application attacks: injection, cross-site scripting, broken access control and other OWASP Top 10 risks.
• Supply chain attacks: compromising a trusted vendor, library or update mechanism to reach downstream targets.
• Insider threats: malicious or negligent actions by employees, contractors or partners.
• Denial-of-service (DoS/DDoS): overwhelming services to make them unavailable.

Frameworks and Standards

Organizations commonly structure their cybersecurity programs around established frameworks:

• NIST Cybersecurity Framework (CSF) 2.0: organizes outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover.
• ISO/IEC 27001:2022: the international standard for establishing and certifying an Information Security Management System (ISMS).
• CIS Critical Security Controls: a prioritized set of technical safeguards for defending against common attacks.
• PCI DSS v4.0.1: mandatory security requirements for entities that store, process or transmit payment card data.
• SOC 2: an AICPA attestation reporting on controls relevant to security, availability, processing integrity, confidentiality and privacy.
• OWASP Top 10 and OWASP ASVS: reference resources for web application security risks and verification requirements.
• MITRE ATT&CK: a knowledge base of adversary tactics and techniques used for threat modeling and detection engineering.

Cybersecurity vs. Information Security vs. IT Security

These terms overlap but differ in scope. Information security protects information in every form, including paper records and verbal communication. IT security focuses on the technology infrastructure an organization operates. Cybersecurity concentrates on protecting systems and data against threats arising in or through cyberspace, such as networks, the internet and connected devices. In practice, most organizations manage all three under a single security program.