Security principles and threats
Cybersecurity protects systems and data from harm. It starts with clear goals, an honest view of threats, and layers of defence.
The CIA triad
Security goals are often summarised as the CIA triad. Confidentiality: only authorised people can read data. Integrity: data cannot be altered without detection. Availability: systems and data are usable when needed. A leaked database breaks confidentiality; a tampered bank record breaks integrity; a website knocked offline breaks availability.
Threats, vulnerabilities, and risk
A vulnerability is a weakness, such as unpatched software or a weak password. A threat is something that could exploit it, such as a criminal group. Risk combines the likelihood of an attack with its impact. Security work prioritises the biggest risks, since perfect security is impossible and resources are limited.
Malware
Malware is malicious software. Viruses attach to files and spread when they run; worms spread across networks by themselves; trojans pretend to be useful programs; spyware secretly gathers information; and ransomware encrypts victims' files and demands payment. Ransomware attacks on hospitals, schools, and businesses have caused major disruption.
Social engineering
Many attacks target people rather than technology. Phishing uses fake emails, texts, or websites to trick people into revealing passwords or running malware. Spear phishing targets specific individuals using personal details. Other tricks include pretexting, inventing a believable story, and baiting with infected USB drives. Training and healthy suspicion are key defences.
Attacks on systems
Denial-of-service (DoS) attacks flood a service with traffic to make it unavailable; distributed versions (DDoS) use many compromised machines, called a botnet. Injection attacks, such as SQL injection, trick a program into running attacker-supplied commands. Man-in-the-middle attacks intercept communication between two parties.
Defence in depth
No single defence is perfect, so systems use layers: firewalls that filter network traffic, regularly patched software, antivirus tools, strong authentication, encryption, backups, monitoring, and user training. The principle of least privilege gives each user and program only the access it needs, limiting the damage if one is compromised.
Safe coding
Many vulnerabilities come from coding mistakes. Programs should validate all input, use parameterised queries instead of building SQL by joining strings, which prevents SQL injection, handle errors safely, and avoid memory errors such as buffer overflows. Security reviews, testing, and keeping software dependencies updated reduce risk.
Worked example
A login form builds the query "SELECT * FROM users WHERE name = '" + input + "'". An attacker types ' OR '1'='1, which makes the condition always true and may log them in without a password. Using a parameterised query passes the input purely as data, never as part of the SQL command, so the trick fails. This is why input should never be pasted directly into commands.
Key takeaways
The CIA triad is confidentiality, integrity, and availability. Risk combines the likelihood and impact of threats exploiting vulnerabilities. Malware includes viruses, worms, trojans, spyware, and ransomware. Social engineering, such as phishing, targets people. DoS and DDoS attacks hit availability; injection and man-in-the-middle attacks hit confidentiality and integrity. Defence in depth layers protections; least privilege limits damage. Safe coding validates input and uses parameterised queries.
Flashcard
Confidentiality, integrity, availability
Check your understanding
A hospital's systems are encrypted by attackers who demand payment to unlock them. Which CIA goal is most directly attacked?