Cybersecurity Fundamentals and Threat Concepts

Vocabulary practice flashcards covering the CIA triad, social engineering techniques, attack types, defenses, malware, network security, and AI threats based on lecture notes.

Confidentiality

Keeping information private.

Integrity

Ensuring data is what it claims to be.

Availability

Ensuring systems work when needed.

Cybersecurity

Protecting the confidentiality, integrity, and availability of information systems and networks — against attacks, accidents, and failures — to protect operations and assets.

Cyber Hygiene

The small set of regular practices, applied consistently, that prevent the great majority of cyber attacks against individuals and organisations from succeeding.

Social Engineering

The act of manipulating a person into taking an action that may not be in their own best interest, by exploiting trust, authority, urgency, or other psychological principles.

Baiting

An attack type where the attacker leaves something desirable where the target will find it, so the target picks it up and runs it.

Scareware

An attack type where the attacker convinces the target their device is already infected, so the target installs the fix, which is the malware.

Pretexting

An attack type where the attacker builds a false identity over several exchanges, so that by the time the real request arrives, the target already trusts them.

Phishing

An attack type where the attacker sends a message/communication impersonating a trusted sender, so the target clicks a link, opens an attachment, or hands over credentials.

Open-source Scraping

A reconnaissance method of looking for personal information available online on platforms like LinkedIn, social media, and conference talks.

Dumpster Diving

A reconnaissance method involving official documents that have been thrown away or discarded improperly.

Shoulder Surfing

A reconnaissance method of watching screens or observing people typing in sensitive details.

Spear Phishing

A personalized attack created using information gathered from open-source scraping.

Whaling

Spear phishing aimed specifically at senior executives, such as the CFO or CEO.

Business Email Compromise

Impersonating a trusted internal voice to authorise a transfer or release of data.

People (Organisational Layer)

The layer consisting of training, awareness, and simulation that turns each employee into an active part of defence.

Protocol (Organisational Layer)

The procedures that make the wrong action hard to take, even when an individual is fooled; independent of any single person.

Tech (Organisational Layer)

The controls that block, flag, or contain attacks before or after a person interacts with them, reducing the load on people.

Malware

Malicious software you did not consent to having on your device.

Spyware

A type of malware targeting confidentiality that records user actions (like typing, saved passwords, and files) and sends them out.

Rootkits

A type of malware targeting integrity that hides the existence of malware by altering the operating system so that it misreports its state.

Ransomware

A type of malware targeting availability that encrypts files so you cannot access them and sells the key back to you.

Patching

A malware control where vendors send out code corrections for defects in their software.

Endpoint Protection

A malware control that detects and protects devices from known malware or suspicious activity that looks like malware.

Network Eavesdropping

A network threat targeting confidentiality where any operator carrying traffic reads what is inside, including the session cookie.

DNS Spoofing

A network threat targeting integrity where a query for a server receives an answer pointing to an attacker-controlled server without changing the address bar name.

Transport Encryption (HTTPS)

A network control that encrypts request contents so any operator carrying it can read nothing usable, countering eavesdropping.

Certificate Validation

A network control where a browser checks if the server holds a certificate for the requested name signed by a trusted authority, countering DNS spoofing.

SQL Injection

A service threat targeting confidentiality where an instruction typed into an ordinary input field is read by the database as a command, sending records out.

Data Tampering

A service threat targeting integrity where values are changed and audit logs edited afterwards so the system visibly reports as healthy.

Denial of Service

A service threat targeting availability where more requests arrive than the service can answer, preventing access while keeping data intact.

Input Validation

A service control where the system treats all input as untrusted and checks it before acting on it.

Least Privilege

A service control where each part of the service reaches only the data it needs, so one compromise cannot read everything.

Prompt Injection

An AI threat targeting integrity where hidden instructions in a document change what the AI does.

Resource Exhaustion

An AI/service threat targeting availability that combines flooding with requests deliberately built to be expensive to answer, increasing costs and wait times.