Introduction to Cybersecurity

Program: Security Foundations, Governance and Risk Module: Security Governance & Compliance Submodule: Introduction to Cybersecurity

This submodule lays the conceptual foundation for the rest of the certificate program. It answers three questions:

1. What is cybersecurity? — how the field is structured and why it looks so fragmented.
2. What are we trying to achieve? — the fundamental goals (CIA / CIAS Triad).
3. What are we defending against? — threats, vulnerabilities, risks, and countermeasures.

---

1. What Is Cybersecurity?

1.1 Why the term is so broad

"Security" as a term has become almost meaningless without context. A private security guard and a software engineer can both truthfully say they "work in security". To make the term useful, we split it into two large categories:

• Physical security — locks, guards, cameras, badges, facilities.
• Cybersecurity — protecting digital systems, data, and the people using them.

1.2 The two fundamental domains of cybersecurity

Cybersecurity itself is traditionally divided into two domains:

Domain	Focus	Typical concerns
Information security	Networks and internetworking	Firewalls, routers, switches, network architecture, segmentation
Application security	Software development and integration	Secure coding, SDLC, vulnerabilities in applications and APIs

These distinctions are useful but increasingly blurry. In practice:

• Information security, application security, physical security, and even privacy are converging.
• Many cybersecurity certifications now cover physical security and privacy extensively, even though privacy was historically treated as a separate discipline.

1.3 The cybersecurity mind map

A popular model of the field is the mind map created by Henry Jiang, which enumerates dozens of specialties and sub-specialties (e.g., threat intelligence, governance, risk, compliance, IAM, cryptography, application security, security operations, etc.).

Key observations from the mind map:

• A person can spend an entire career specializing in a single node of the map.
• The map is not exhaustive — more nodes could always be added.
• The field is complex because cybersecurity activities are a byproduct of technological change. Wherever people, processes, and technology intersect, cybersecurity implications appear.

1.4 Why governance matters

An organization is rarely in the business of doing cybersecurity for its own sake — it exists to sell products, provide services, or fulfill a mission. So how does it make sense of the sprawling cybersecurity landscape in relation to what it actually does?

The answer is governance. Governance brings coherence to how an organization approaches, strategizes, and prioritizes cybersecurity in relation to its business goals. It is the connective tissue between the mind map of specialties and the concrete needs of the organization. Governance is covered in depth in later lectures.

---

2. The Fundamental Goals of Cybersecurity: The CIA Triad

All the activities on the mind map ultimately serve the same three high-level goals, known as the CIA Triad.

2.1 Confidentiality

Definition: Preserving restrictions on information disclosure so that access is limited only to authorized users and services.

Examples of sensitive information categories where confidentiality is paramount:

• PHI — Personal Health Information
• PII — Personally Identifiable Information (e.g., SSNs, birthdays, addresses)
• Classified / sensitive government information

Many of these categories are subject to extensive regulation, which is why confidentiality is often the most visible of the three goals from a legal and compliance standpoint.

2.2 Integrity

Definition: Ensuring that sensitive data has not been modified or deleted in an unauthorized or undetected manner.

Key points:

• Databases are a classic integrity concern — tampering with database records "for fun or for profit" has been a common attack technique for decades.
• Integrity failures often occur by mistake, not by malice. This drives principles such as:
  • Least privilege — don't over-scope access levels.
  • Avoiding blanket administrator rights — administrators can delete or alter data at will.

2.3 Availability

Definition: Ensuring timely and reliable access to and use of information.

• The modern world depends on interconnected technology in the same way it depends on electricity or clean tap water — largely invisibly.
• The internet functions only because many underlying protocols work in tandem. When availability issues arise in these underlying technologies, the disruption can be just as severe as a public-facing website going offline.

2.4 Extension: The CIAS Triad (adding Safety)

With the rise of IoT (Internet of Things) devices — smart TVs, doorbell cameras, connected baby monitors and toys, and especially devices that control machinery and manufacturing equipment — a fourth concern has emerged:

• Safety — reducing risks associated with embedded/IoT technologies that could fail or be manipulated by malicious actors, potentially causing physical harm to humans.

The traditional three goals still apply; safety is layered on top for domains where cyber failures can cause physical consequences.

2.5 How the goals apply

• Different industries and use cases weight the four concerns differently (e.g., healthcare emphasizes confidentiality; industrial control systems emphasize availability and safety).
• However, there is significant overlap between them — a single incident often touches multiple goals at once.
• Aligning these goals across the many specialties in the cybersecurity mind map is what makes coherent security strategy possible.

---

3. Core Concepts: Threats, Vulnerabilities, Risks, and Countermeasures

The CIA/CIAS Triad only makes sense if someone is trying to undermine those goals. This section defines the "cat-and-mouse" vocabulary that underpins the rest of the field.

3.1 Threats (and threat actors)

A threat (or threat actor) is a party motivated to attack and take advantage of data and information systems. Understanding the landscape of threats is its own specialty — threat intelligence — which appears on the cybersecurity mind map.

Two broad categories are useful at this stage:

3.1.1 Cybercrime

• Top priority: making money.
• Historically targeted only inherently valuable data — credit card numbers, SSNs, financial data, identity data.
• Two developments have dramatically expanded the attack surface:
  • Viable cryptocurrencies — enable anonymous payment.
  • Commodified encryption — anyone can strongly encrypt data.
• Together these enable ransomware: criminals can now hold any data hostage, even data that would otherwise have been worthless.

3.1.2 Nation-states

• Concerned with espionage, national secrets, and geopolitical tensions.
• Feels remote to most people, but the timeless issues of espionage, fraud, and crime have not gone away — technology has only made them faster and emboldened the actors.
• There is significant overlap between cybercriminals and nation-states, which is a recurring topic in threat intelligence reporting.

3.2 Vulnerabilities

A vulnerability is a weakness or a lack of countermeasures. For a threat to cause harm, it must find a way in — typically by exploiting a vulnerability.

Vulnerabilities can exist in:

• Software and applications
• Hardware and firmware
• Business processes
• Human beings — including the assumptions we rely on in everyday life (social engineering, phishing)

Because technology changes constantly, new features and configurations arrive continuously — and with them, new bugs, flaws, and potential vulnerabilities at an equal pace. There is no "finished" state of cybersecurity; we can only manage risk as it evolves.

3.3 Risk

Risk is the degree to which threats and vulnerabilities intersect. Evaluating risk means asking:

• How serious are the vulnerabilities we have?
• How present or motivated are the threat actors that could exploit them?

Risk is what governance and risk management programs are ultimately designed to prioritize and reduce — the topic of the rest of the certificate program.

3.4 Countermeasures (security controls)

Countermeasures mitigate vulnerabilities. They range from:

• Patches and updates
• Security devices and services (firewalls, EDR, IDS/IPS, etc.)
• Process and policy changes
• Training and awareness

Countermeasures are more formally called security controls, a term that will reappear when we cover governance frameworks in an upcoming lecture.

3.5 Putting it together

The interlocking relationships:

• Cybersecurity protects confidentiality, integrity, availability, and safety.
• Those goals need protection because threats exist.
• Threats succeed only when there are vulnerabilities.
• The intersection of threats and vulnerabilities is risk.
• Countermeasures mitigate vulnerabilities and therefore reduce risk.

---

4. Key Takeaways

• Cybersecurity is broad and fragmented because it is a byproduct of continuous technological change; the Henry Jiang mind map is a useful way to visualize its many specialties.
• The traditional foundation of the field is the CIA Triad: Confidentiality, Integrity, Availability.
• Safety is increasingly added (giving the CIAS Triad) due to IoT and embedded systems that control physical processes.
• Cybersecurity only makes sense in the presence of threat actors — primarily cybercriminals (money-driven, now empowered by cryptocurrency and ransomware) and nation-states (espionage and geopolitics), with significant overlap.
• Threats succeed by exploiting vulnerabilities in software, hardware, processes, or people.
• The intersection of threats and vulnerabilities produces risk, which is what security programs manage.
• Countermeasures (a.k.a. security controls) mitigate vulnerabilities and reduce risk.
• Making sense of all this at the organizational level requires governance, which is the subject of the next lectures.

---

5. Glossary

Term	Definition
CIA Triad	Confidentiality, Integrity, Availability — the three traditional goals of cybersecurity.
CIAS Triad	CIA plus Safety, reflecting IoT/embedded-system concerns.
Confidentiality	Restricting information disclosure to authorized users and services.
Integrity	Ensuring data is not modified or deleted in an unauthorized or undetected way.
Availability	Ensuring timely, reliable access to information and systems.
Safety	Reducing risk that embedded/IoT technology failures or manipulation cause physical harm.
PII	Personally Identifiable Information (e.g., SSN, address, DOB).
PHI	Personal Health Information.
IoT	Internet of Things — networked embedded devices.
Threat / Threat Actor	An entity motivated to attack systems, data, or people.
Threat Intelligence	The specialty of studying and reporting on the threat landscape.
Vulnerability	A weakness or lack of countermeasures in software, hardware, process, or people.
Risk	The degree to which threats and vulnerabilities intersect.
Countermeasure / Security Control	Any measure (technical, procedural, or human) that mitigates a vulnerability.
Governance	Organizational structures and processes that align cybersecurity activities with business goals.
Information Security	Cybersecurity domain focused on networks and internetworking.
Application Security	Cybersecurity domain focused on software development and integration.

---

6. What's Next

Upcoming lectures in this module build directly on this foundation:

• Cybersecurity governance — aligning the sprawling landscape with organizational goals.
• Legal and regulatory compliance — the rules that shape confidentiality, integrity, and availability requirements.
• Cybersecurity policies and procedures — how governance is operationalized day-to-day.
• Governance frameworks and security controls — the formal structures that codify countermeasures.