Cybersecurity Essentials

Brief

At Alder Dispatch, 80 staff schedule deliveries through a customer portal. A stolen account exports addresses, a payment destination changes, and a traffic surge blocks bookings. The operations lead calls all three events data leaks and says last month's compliance review proves the portal is secure.

You must separate what was harmed, how it happened, and what evidence supports recovery. The same incident can affect several security objectives, but naming the primary impact helps assign controls and owners. Neither a clean checklist nor an alarming label substitutes for investigating the facts.

Confidentiality, integrity, and availability

Confidentiality means information is disclosed only to authorized people or processes. A stolen account exporting 600 customer addresses breaches confidentiality even if every record remains correct and the portal stays online. Restrict access by role, minimize retained data, and encrypt it in storage and transit. Encryption alone does not stop an authorized session from reading plaintext it is allowed to retrieve.

Integrity means protecting information and systems against improper alteration or destruction. Changing one supplier's payment destination from the approved account to an attacker's account harms integrity even if nobody steals the file. Approval separation, input validation, and protected change logs help. A hash compared with a trusted reference detects changes; an attacker replacing both the file and an unprotected reference can defeat that comparison.

Availability means authorized users can access services and information when required. If bookings fail for 30 minutes in a 30-day, 43,200-minute month, measured availability is 43,170 / 43,200 = approximately 99.93%, assuming all minutes count. Define the measurement window and exclusions before quoting a percentage. Auditors ask for access logs, authorized change records, outage measurements, and restore tests, not merely a statement that backups exist.

Authenticity and non-repudiation are different claims

Authenticity concerns whether a person, message, or artifact is genuinely what it claims to be. A message bearing the finance director's display name is not proof of origin. Verify a sensitive payment instruction through a separately established contact route. Authentication verifies a claimed identity; authorization determines what that verified identity may do. A genuine employee can still lack permission to approve a payment.

Non-repudiation provides evidence supporting attribution of an action so its originator cannot credibly deny it. A digital signature tied to an individually controlled private key, validated certificate, trusted timestamp, and preserved transaction can support this claim. It does not establish that the signed statement was true, that the signer understood it, or that a court must accept it. Shared accounts weaken attribution because several people could have acted.

Suppose two clerks share one approval account and 12 transfers appear in its log. The log shows account activity, not which clerk approved which transfer. Individual identities, protected audit trails, and controlled signing keys provide stronger evidence. An auditor asks how identities were enrolled, who could use the credentials, and whether records could be altered. Do not confuse a typed name, ordinary checksum, or shared password with robust proof of origin.

Threats, actors, vulnerabilities, and exploits

A threat is a potential cause of harm, such as unauthorized access or a service-disrupting flood. A threat actor is the person or group capable of causing intentional harm: for example, a criminal group or a malicious employee. Some threats, including equipment failure, have no malicious actor. A vulnerability is a weakness that could be exploited, such as missing access checks or an unpatched component.

An exploit is a technique or code that takes advantage of a vulnerability. A missing ownership check is the weakness; a crafted request that retrieves another customer's invoice uses it. Finding a weakness is not evidence it was successfully exploited. If 200 invoices were potentially reachable but logs confirm 8 unauthorized reads, report 200 as potential exposure and 8 as confirmed observations, with any logging limitations stated.

Risk combines uncertainty about likelihood with consequences in context. A severe weakness on an isolated test service may present a different risk from the same weakness on a public payment service; severity scores alone do not establish business impact. Auditors ask for the asset, weakness, plausible threat, existing safeguards, evidence of exposure, and accountable owner. Calling the criminal a vulnerability hides the fixable system condition.

Recognize common attack mechanisms

Phishing uses deceptive messages to induce disclosure or an unsafe action; it can steal credentials without installing software. Malware is malicious software, while ransomware is a malware category that may encrypt data or disrupt access, often alongside theft and extortion. Credential stuffing tries username-password pairs stolen elsewhere against another service, exploiting password reuse. It differs from guessing many possible passwords for one account; neither requires discovering a software flaw first.

Injection occurs when untrusted input is interpreted as commands or query structure rather than data. Parameterized queries and context-appropriate validation help keep that boundary intact. Denial of service exhausts capacity or otherwise prevents legitimate use; distributed denial of service uses multiple sources. Traffic volume alone does not prove an attack: a legitimate demand spike can also overload a service. An insider incident involves someone with trusted access; it may be malicious or arise from negligent behavior, so avoid assuming intent from an account name alone.

Classifications can overlap. A phished employee may run malware that steals credentials, followed by ransomware deployment; an insider can also launch an injection attack. If 1,000 reused credential pairs yield 20 successful logins, the observed success rate is 2%, not proof the remaining accounts are safe. Investigators and auditors need message samples, login patterns, process evidence, and application logs appropriate to the claimed mechanism, rather than a single generic 'hacked' label.

Interrupt the lifecycle with layered controls

A high-level attack lifecycle can include reconnaissance, initial access, execution, persistence, privilege escalation or lateral movement, and actions on objectives such as theft or disruption. This is an explanatory model, not a required sequence: an insider may start with access, and an attacker may repeat or skip stages. Map evidence to the observed steps without assuming later stages occurred just because an early one did.

Defence in depth uses complementary preventive, detective, and corrective controls across people, processes, and technology. Training and message screening reduce phishing opportunities; multifactor authentication limits use of stolen passwords; least privilege and segmentation constrain reach; monitoring detects suspicious behavior; tested isolated backups support recovery. Two filters using the same rule source can fail together. Layers should address different failure modes rather than duplicate one reassuring label.

If an attacker steals a password but cannot satisfy the second factor, initial access may fail. If a session is nevertheless stolen, restricted roles limit accessible records and export monitoring can trigger containment. A recovery exercise restoring 500 records in 40 minutes provides evidence against a 60-minute recovery target, but does not show that stolen copies were erased. Auditors ask for actual coverage, bypass paths, alert handling, and dated recovery results, not just a purchased control inventory.

Security versus compliance

Security manages risk to assets and operations. Compliance means meeting specified obligations, which may come from laws, contracts, or internal policies. They overlap, but neither implies the other. A compliant annual access review may leave an account enabled after an employee leaves if daily offboarding is ineffective; a strong technical control may still lack required approval records or miss a legal retention obligation.

A review sampled 10 of 80 accounts and found no exceptions. That supports a conclusion about the sample and review scope, not a guarantee that all 80 accounts were continuously protected. Record the period, population, selection method, and limitations. A policy requiring backups is control design; dated backup logs and successful restore tests support operating effectiveness. A certificate or signed checklist cannot replace evidence of how a specific control operated.

Use obligations as a baseline, then assess threats, consequences, and residual risk. Assign remediation owners and deadlines, verify fixes, and document authorized risk acceptance where appropriate. Auditors ask which requirement applies, what control addresses it, and what evidence demonstrates performance. Security teams additionally ask whether that control meaningfully reduces current risk; a control can meet narrow wording while failing against the incident actually unfolding.

Answers are graded on the server: the answer key never reaches your browser.