In today's interconnected world, understanding cyber security is no longer optional; it's a

necessity. From our personal photos to global financial transactions, almost everything relies on
digital systems. This unit, "Introduction to Cyber Security," will demystify the core concepts,
common threats, and essential defenses in simple language.

Basic Cyber Security Concepts

At its heart, cyber security is about protecting internet-connected systems, including hardware,
software, and data, from cyber threats. Think of it like safeguarding your physical home: you
lock your doors, set up an alarm, and maybe even have a guard dog. In the digital realm, these
protections are more complex but serve the same purpose: to prevent unauthorized access,
damage, or disruption.
Layers of security refers to the idea of having multiple defensive measures in place, rather
than relying on a single one. Just as an onion has many layers, a robust security system does
too. These layers can include firewalls, antivirus software, strong passwords, encryption, and
employee training. If one layer is breached, another is there to catch the attack.
A vulnerability is a weakness or a flaw in a system that can be exploited by an attacker.
Imagine a crack in your house's foundation – that's a vulnerability. In software, it could be a bug
in the code; in a network, it might be an open port.
A threat is a potential danger that could exploit a vulnerability. The crack in your foundation is a
vulnerability, but a burglar looking for easy entry is a threat. In cyber security, threats can come
from various sources: malicious hackers, disgruntled employees, nation-states, or even natural
disasters.
Harmful acts are the actual incidents that result from a threat exploiting a vulnerability. These
are the "bad things" that happen, such as data theft, system shutdowns, or financial fraud.
The motive of attackers can vary widely. Some are driven by financial gain (e.g., stealing credit
card numbers). Others might be motivated by political ideologies (cyber activism), personal
grievances (revenge), or even just the challenge and recognition (bragging rights). Nation-states
engage in cyber warfare for strategic advantages.

Types of Attacks
Cyber attacks can be categorized in several ways:
Active attacks involve an attacker directly interacting with and altering system resources or
data. Examples include modifying data, injecting malware, or launching denial-of-service
attacks. Think of someone actively trying to break into your house.
Passive attacks, on the other hand, involve an attacker monitoring or eavesdropping on system
communications without altering them. This is like someone secretly listening in on your phone
calls or looking through your mail. Examples include wiretapping and traffic analysis.
Software attacks target vulnerabilities in software applications. This can include viruses,
worms, ransomware, Trojan horses, and spyware. These attacks aim to disrupt, gain control, or
steal data from software.
Hardware attacks focus on manipulating or compromising physical hardware components. This
might involve tampering with circuit boards, inserting malicious devices, or exploiting
vulnerabilities in embedded systems.
The spectrum of attacks is vast, ranging from simple phishing scams to highly sophisticated,
nation-state-sponsored cyber warfare.
A taxonomy of various attacks helps us categorize and understand the different methods
attackers use. Common categories include:
●​ Malware: Malicious software (viruses, worms, Trojans, ransomware).
●​ Phishing: Deceptive attempts to trick individuals into revealing sensitive information.
●​ Denial-of-Service (DoS) / Distributed Denial-of-Service (DDoS): Overwhelming a
system with traffic to make it unavailable.
●​ Man-in-the-Middle (MitM): Intercepting communication between two parties.
●​ SQL Injection: Exploiting vulnerabilities in databases to gain unauthorized access.
●​ Cross-Site Scripting (XSS): Injecting malicious scripts into websites.
●​ Zero-day exploits: Attacks that exploit newly discovered vulnerabilities before a patch is
available.
IP spoofing is a technique where an attacker disguises their IP address to appear as if they are
a legitimate user or device. This is like sending a letter with a fake return address to trick the
recipient. It's often used in DoS attacks or to bypass network security measures.

Methods of Defense
Just as there are many types of attacks, there are also numerous methods of defense:
●​ Firewalls: Act as a barrier between your internal network and the outside world,
controlling incoming and outgoing network traffic.
●​ Antivirus/Anti-malware software: Detects and removes malicious software.
●​ Encryption: Converts data into a coded format to prevent unauthorized access.
●​ Strong passwords and multi-factor authentication (MFA): Makes it harder for
attackers to guess or steal login credentials.
●​ Regular software updates and patching: Fixes vulnerabilities in software.
●​ Intrusion Detection/Prevention Systems (IDS/IPS): Monitor network traffic for
suspicious activity and can even block attacks.
●​ Security awareness training: Educating users about cyber threats and safe practices.
●​ Data backups: Ensuring that data can be restored in case of loss or corruption.
Security Models are frameworks that define how security should be implemented and
maintained within an organization. Examples include the Bell-LaPadula model (focuses on
confidentiality) and the Biba model (focuses on integrity). These models provide a structured
approach to designing secure systems.
Risk management is the process of identifying, assessing, and controlling cyber risks. It
involves understanding what assets need protection, what threats they face, the likelihood of
those threats materializing, and the potential impact. Organizations then prioritize and
implement security controls to mitigate these risks to an acceptable level.

Cyber Threats
The landscape of cyber threats is constantly evolving, with new sophisticated attacks emerging
regularly. Some prominent categories include:
Cyber Warfare: This involves nation-states using cyber attacks as a weapon to achieve
strategic objectives. This could include disabling critical infrastructure (power grids,
communication networks), stealing state secrets, or spreading propaganda.
Cyber Crime: This is any crime committed using a computer or network. It's often financially
motivated and includes activities like identity theft, credit card fraud, ransomware attacks, and
online scams. Cybercrime is a booming industry, with sophisticated criminal organizations
operating globally.
Cyber Terrorism: This involves the use of cyber attacks by terrorist groups to cause
widespread fear, disruption, or to achieve political goals. This could involve attacking critical
infrastructure, spreading extremist propaganda, or recruiting new members online.
Cyber Espionage: This is the act of stealing secret information from individuals, competitors, or
governments using cyber methods. It's often carried out by nation-states or corporate entities for
economic or political gain. This can involve stealing intellectual property, trade secrets, or
classified government documents.

CIA Triad
The CIA Triad is a fundamental concept in information security, representing three core
principles that underpin a secure system: Confidentiality, Integrity, and Availability. It's like
the three pillars supporting the entire edifice of cyber security.
●​ Confidentiality: This principle ensures that information is accessible only to authorized
individuals or systems. It's about preventing unauthorized disclosure of sensitive data.
Think of it like keeping your private diary locked away, accessible only to you.
○​ Examples: Encrypting sensitive data, using strong passwords, access controls
(limiting who can see what), and proper data handling procedures.
○​ Threats to Confidentiality: Eavesdropping, unauthorized data access, sniffing
network traffic, social engineering (tricking someone into revealing information), and
weak authentication.
●​ Integrity: This principle guarantees that information is accurate, complete, and has not
been tampered with or altered in an unauthorized manner. It's about maintaining the
trustworthiness and reliability of data. Imagine ensuring that a financial transaction
amount remains exactly as entered, without any hidden changes.
○​ Examples: Hashing (creating a unique digital fingerprint of data to detect changes),
digital signatures, access controls (preventing unauthorized modification), version
control systems, and data validation.
○​ Threats to Integrity: Data tampering, unauthorized data modification, malware
(like viruses that corrupt files), SQL injection attacks (altering database content),
and human error.
●​ Availability: This principle ensures that authorized users can access information and
systems when needed. It's about making sure that the resources and services are
operational and accessible. Think of a website being up and running when you want to
visit it, or your online banking system being accessible 24/7.
○​ Examples: Redundant systems (having backup systems in case one fails), regular
system maintenance, disaster recovery plans, robust network infrastructure, and
efficient patching schedules.
○​ Threats to Availability: Denial-of-Service (DoS) and Distributed Denial-of-Service
(DDoS) attacks (overwhelming a system to make it unavailable), hardware failures,
natural disasters, power outages, and ransomware (encrypting data and demanding
payment for its release, thus making it unavailable).
These three principles are interconnected and equally important. A breach in one can impact
the others. For instance, if confidentiality is compromised (data is stolen), it might also affect
integrity if the stolen data is then altered and used for malicious purposes. Similarly, a
denial-of-service attack directly impacts availability, preventing legitimate users from accessing
resources.
In conclusion, cyber security is a dynamic and essential field. By understanding basic concepts,
recognizing various threats and attacks, implementing robust defense mechanisms, and
adhering to principles like the CIA Triad, individuals and organizations can significantly enhance
their digital resilience in an increasingly interconnected world.