Cybersecurity

The CIA triad stands for Confidentiality, Integrity, and Availability, forming the three core principles of information security. Confidentiality ensures data is accessible only to authorized parties, integrity ensures data is accurate and unaltered, and availability ensures systems and data are accessible when needed.

Encryption is the process of converting plaintext data into an unreadable format (ciphertext) using mathematical algorithms and cryptographic keys. Only authorized parties with the correct decryption key can reverse the process and access the original data. Encryption is fundamental to securing data both at rest and in transit.

A firewall is a network security device or software that monitors and controls incoming and outgoing network traffic based on predetermined security rules. Firewalls establish a barrier between trusted internal networks and untrusted external networks such as the internet. Modern next-generation firewalls (NGFWs) also perform deep packet inspection, intrusion prevention, and application-level filtering.

Malware is any software intentionally designed to cause damage, disrupt operations, or gain unauthorized access to computer systems. Common types include viruses, worms, trojans, ransomware, spyware, and rootkits. Each type has distinct propagation methods and payloads, but all pose serious threats to system security.

Phishing is a social engineering attack in which an attacker disguises themselves as a trustworthy entity to trick victims into revealing sensitive information such as login credentials, financial data, or personal details. Phishing attacks are commonly delivered via email but also occur through SMS (smishing), voice calls (vishing), and fraudulent websites.

A zero-day exploit targets a previously unknown vulnerability in software or hardware that the vendor has not yet patched. The term 'zero-day' refers to the fact that developers have had zero days to address the flaw. These exploits are particularly dangerous because no defense or signature exists at the time of attack.

Penetration testing (pen testing) is an authorized, simulated cyberattack performed on a system to evaluate its security posture. Pen testers use the same tools and techniques as malicious hackers but operate within a defined scope and legal agreement. The goal is to identify vulnerabilities before real attackers can exploit them.

Authentication is the process of verifying the identity of a user, device, or system before granting access to resources. It typically relies on one or more factors: something you know (password), something you have (security token), or something you are (biometrics). Multi-factor authentication (MFA) combines two or more factors for stronger security.

Network security encompasses the policies, practices, and technologies designed to protect the usability, reliability, integrity, and safety of a network and its data. It involves both hardware and software solutions and addresses threats that seek to enter, spread within, or exfiltrate data from a network.

Incident response is the organized approach to addressing and managing the aftermath of a security breach or cyberattack. The goal is to handle the situation in a way that limits damage, reduces recovery time and costs, and prevents future occurrences. A typical incident response plan includes preparation, identification, containment, eradication, recovery, and lessons learned phases.