Cybersecurity is protecting systems, networks and data from attacks and misuse. Its core goals are confidentiality (only the right people see data), integrity (data is not altered wrongly) and availability (systems work when needed). Common threats include phishing, malware, ransomware, weak passwords and misconfigurations. Defence combines technology, processes and aware people.
The CIA triad
Security professionals think in three goals:
- Confidentiality: keeping information private, through access controls and encryption.
- Integrity: keeping information accurate and unaltered, through checks, permissions and logs.
- Availability: keeping systems running for legitimate users, through backups, redundancy and protection against overload attacks.
Common threats
| Threat | What it is | Basic defence |
|---|---|---|
| Phishing | Deceptive messages tricking people into revealing information or clicking malicious links | Awareness, email filtering, verification |
| Malware | Malicious software, including viruses and spyware | Updates, antivirus, careful downloads |
| Ransomware | Malware that encrypts data and demands payment | Backups, updates, limited permissions |
| Weak or reused passwords | Easily guessed or leaked credentials | Password managers, two-factor authentication |
| Misconfiguration | Systems left open by mistake, such as public cloud storage | Reviews, secure defaults, monitoring |
| Unpatched software | Known vulnerabilities left unfixed | Regular updates |
| Insider threats | Misuse by people with legitimate access | Least privilege, logging |
How attacks typically happen
Many attacks follow a pattern: gather information, gain an initial foothold (often through phishing or a vulnerability), increase access, move through the network, then steal data or cause damage. Defenders aim to break this chain at every stage.
Defence in depth
No single control is enough. Organisations layer protections: trained people, strong authentication, updated systems, firewalls, monitoring, backups and incident response plans.
Personal security basics
- Use a password manager and unique passwords.
- Turn on two-factor authentication; see password security and 2FA.
- Keep devices and apps updated.
- Be cautious with links and attachments; see how to recognise phishing scams.
- Back up important files.
Learning cybersecurity
Start with networking and Linux, then security fundamentals, then hands-on practice in legal training labs. See how to start a career in cybersecurity and our cybersecurity course.
Frequently asked questions
Is cybersecurity only about hacking?
No. Most security work is defensive: configuring systems securely, monitoring, responding to incidents, managing risk and training people.
Do I need to be good at maths?
Not for most roles. Cryptography research is maths-heavy, but most practitioners need logical thinking and technical understanding.
Is ethical hacking legal?
Only with explicit written permission from the system owner, or in training environments built for practice.
