What is cyber security? – a clear definition

What is cyber security?

Cyber security is the practice of protecting computers, networks, and data from unauthorized access, damage, or theft. It combines people, processes, and technology that work together to keep information safe.

Core principles

The field rests on three ideas often called the CIA triad:

• Confidentiality – only authorized users may see the data.
• Integrity – data must not be altered without permission.
• Availability – legitimate users must be able to reach the system when they need it.

Every security decision tries to balance these goals.

How it works

1. Identify assets – List the hardware, software, and data that are valuable. For a school, this might include student records, the learning-management system, and the Wi-Fi network.
2. Model threats – Ask how an attacker could reach each asset. Common paths are phishing emails, infected USB drives, exploiting unpatched software, or abusing default passwords on IoT devices.
3. Assess risk – Estimate how likely each threat is and how much damage it could cause. A high-risk item gets priority for protection.
4. Apply controls – Choose preventive measures (firewalls, strong passwords, encryption), detective measures (intrusion-detection logs, anti-malware scans), and corrective measures (patch management, backup restoration). Controls are often grouped as follows:

Control type	Example
Preventive	Network firewall that blocks inbound traffic on unused ports
Detective	Log-analysis system that alerts on multiple failed login attempts
Corrective	Automated script that restores a corrupted database from the latest backup

5. Monitor continuously – Collect logs, set alerts for unusual activity, and review them daily or weekly. Monitoring tools can flag a sudden spike in outbound traffic that may indicate data exfiltration.
6. Respond to incidents – Follow a predefined plan that isolates the affected system, removes malicious code, and informs stakeholders. The plan should assign roles (who calls the vendor, who communicates with management) and define communication channels.
7. Recover and improve – Restore data from backups, verify integrity, and update the risk assessment to prevent repeat attacks. Post-incident reviews often reveal gaps in training or configuration that can be fixed.

Worked example

Liam runs a small tutoring centre that stores client contact details on a spreadsheet stored in the cloud.

• Asset – the spreadsheet and the cloud account that holds it.
• Threat – an attacker could guess the password or trick Liam into revealing it.
• Risk – exposure of personal data could breach privacy laws and damage reputation.

Liam takes these steps:

1. Creates a password T!t0r2024$ that mixes upper-case, lower-case, numbers, and symbols.
2. Enables two-factor authentication, so a code is sent to his phone each time he signs in.
3. Encrypts the spreadsheet before uploading it, using a key only he knows.
4. Sets the cloud folder to “share with specific people” instead of “anyone with the link”.
5. Turns on the cloud provider’s activity alerts; when a login occurs from a new city, he receives an email.
6. Keeps a weekly backup on an external hard drive that is stored offline.

When the alert arrives showing a login from a city Liam has never visited, he immediately revokes the session, changes the password, and restores the latest backup. The incident is logged and later used to tighten his security checklist.

Additional example: phishing attack on a university

A university professor receives an email that appears to come from the IT department, asking for a password reset link. The link leads to a clone of the university’s login page. The professor enters credentials, which are captured by the attacker. The attacker now has confidentiality breach (access to the professor’s email) and can modify course materials, violating integrity. The university’s incident-response team detects the unusual login pattern, blocks the attacker’s IP, forces a password reset for all faculty accounts, and sends a reminder about phishing awareness. This illustrates how a single social-engineering threat can affect multiple pillars of the CIA triad.

Common beginner mistakes

Mistake	Why it hurts
Using easy passwords like password or 123456	Attack tools can guess them in seconds.
Ignoring software updates	Known flaws stay open for exploitation.
Turning off security alerts	Early warning signs are missed.
Relying on a single security layer	Attackers can bypass one control; layered defense is stronger.
Sharing credentials over chat or email	Gives others the ability to misuse the account.
Skipping regular backups	Data loss becomes permanent after ransomware or hardware failure.
Assuming “it won’t happen to me”	Overconfidence leads to lax practices and higher exposure.

Real-world uses

• Online banking – Banks encrypt every transaction, monitor login patterns, and require multi-factor authentication to keep account balances safe.
• Corporate networks – Large firms deploy firewalls, intrusion-detection systems, and mandatory security training to protect customer data and intellectual property.
• E-commerce sites – Retailers use TLS encryption, secure payment gateways, and fraud-detection algorithms to safeguard credit-card information.
• Healthcare providers – Hospitals store patient records under strict confidentiality rules, applying encryption and audit logs to comply with privacy regulations.
• Internet of Things (IoT) devices – Smart thermostats and cameras are secured with firmware updates and network segmentation to prevent them from becoming entry points for larger attacks.
• Cloud services – Providers offer identity-and-access-management tools, encryption-at-rest, and role-based permissions so organizations can enforce least-privilege access.

For a deeper look at how these ideas fit into a larger curriculum, see the Bastion course.

Security culture and education

Technical controls are only part of the solution. A culture that encourages reporting suspicious activity, regular training on phishing, and clear policies on device usage dramatically reduces risk. Students who understand why a strong password matters are more likely to adopt good habits early. Teachers can reinforce these habits by modeling secure behavior, such as using password managers and updating software promptly.

Check yourself

1. What are the three pillars of the CIA triad?
   Answer: Confidentiality, integrity, and availability.

2. Why does a layered defence improve security?
   Answer: If one control fails, other controls can still block or detect the attack, reducing overall risk.

3. Name one common mistake beginners make when handling backups.
   Answer: Storing backups on the same device as the original data, which can be destroyed together in an attack.