Introduction & CIA Triad

What is Cyber Security?

Protecting digital assets (data, systems, networks) against unauthorized access, misuse, disruption, or destruction.

• Assets: information, hardware, software, people.
• Threats: actors + methods that may harm assets.
• Vulnerabilities: weaknesses that can be exploited.
• Risk: likelihood × impact of a threat exploiting a vulnerability.

CIA Triad

• Confidentiality — prevent unauthorized disclosure (encryption, access controls)
• Integrity — prevent unauthorized modification (hashing, checksums, signatures)
• Availability — ensure timely access (redundancy, backups, DDoS protection)

Security Controls

• Administrative: policies, standards, awareness training, background checks.
• Technical: encryption, IDS/IPS, firewalls, EDR, MFA, patching.
• Physical: locks, guards, CCTV, environmental controls.

Type	Preventive	Detective	Corrective
Example	MFA, firewall rules	SIEM alerts, IDS	Backups, incident response

Risk Management

• Identify assets and data classification (public, internal, confidential).
• Threat modeling (STRIDE): Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.
• Assess likelihood and impact (qualitative/quantitative).
• Choose treatment: mitigate, transfer (insurance), accept, or avoid.