Comprehensive Introduction to Cybersecurity and the CIA Triad

Definition of Cybersecurity: Cybersecurity is defined as the multi-faceted practice of protecting systems, networks, programs, and data from digital attacks, unauthorized access, and damage.
The Primary Mission: The central objective of all cybersecurity initiatives is to uphold the CIA Triad:
- Confidentiality: Ensuring that data is kept secret and is only accessible to authorized individuals or systems, preventing unauthorized discovery.
- Integrity: Guaranteeing that data remains accurate, consistent, and unaltered throughout its lifecycle, ensuring it is only changed by authorized parties.
- Availability: Maintaining that systems and data are accessible and usable whenever they are required by authorized users.

Protection of Sensitive Data: It is essential for safeguarding critical information assets, including:
- Personal identifying information.
- Financial records and transaction history.
- Intellectual property and trade secrets.
Prevention of Business Disruption: Effective security measures prevent the fallout from cyberattacks, which include:
- System downtime.
- Lost productivity.
- Substantial incident response costs.
Legal and Regulatory Compliance: Cybersecurity helps organizations satisfy mandatory obligations such as:
- GDPR (General Data Protection Regulation).
- HIPAA (Health Insurance Portability and Accountability Act).
- PCI DSS (Payment Card Industry Data Security Standard).

Historical Shift: Security has evolved from the protection of isolated, single computers to the protection of complex, interconnected ecosystems, including:
- Enterprise-scale networks.
- Cloud services and hybrid environments.
- Mobile devices.
- IoT (Internet of Things) Devices: This represents a vastly expanded attack surface, encompassing smart TVs, routers, security cameras, and appliances.
Current Security Trends: The field is currently defined by:
- AI-assisted attacks and AI-driven defensive measures.
- The Zero Trust security model.
- Advanced threat detection and rapid response.
- Dedicated cloud security architectures.

Objective: To ensure information is only accessible by authorized people or systems.
Technical Controls and Examples:
- Encryption: Utilizing algorithms for data at rest and in transit, such as $\text{AES}$ for stored data and $\text{TLS}$ for web traffic.
- Authentication and Access Controls: Implementation of Strong Multi-Factor Authentication (MFA), the principle of least-privilege, and Role-Based Access Control (RBAC).
- Secure Remote Access: Utilizing Virtual Private Networks (VPNs) for encrypted remote connections.
Common Threats to Confidentiality:
- Phishing and various forms of social engineering used to steal credentials.
- Eavesdropping or "sniffing" on unencrypted network traffic (e.g., using HTTP instead of HTTPS).
- Data leaks resulting from system misconfigurations, such as public-facing cloud storage or exposed databases.

Objective: To ensure data remains accurate and consistent, remaining free from unauthorized or accidental modification.
Technical Controls and Examples:
- Hashing: Using cryptographic hashes (e.g., $\text{SHA-256}$ ) to verify file and data integrity.
- Digital Signatures: Implementing signatures to prove the authenticity of the sender and ensure the data has not been tampered with.
- Auditing and Logging: Maintaining access controls and detailed audit logs that track who changed what data and when.
- Change Management: Using version control for code and robust backup systems for data rollbacks.
Common Threats to Integrity:
- Man-in-the-Middle (MitM) Attacks: Intercepting and altering data during transmission.
- Unauthorized modifications performed by external attackers, malware, or malicious insiders.
- Data corruption caused by software bugs, system misconfigurations, or hardware failures in storage devices.

Objective: To ensure that systems and data are available for use when authorized users need them.
Technical Controls and Examples:
- Infrastructure Resilience: Implementing redundancy (multiple servers and network paths), failover mechanisms, and load balancing.
- Recovery Preparedness: Maintaining backups and Disaster Recovery (DR) plans with regularly tested restore procedures.
- Operational Monitoring: Constant monitoring and incident response to detect and mitigate outages rapidly.
- Traffic Management: Deploying DDoS protection and rate-limiting to maintain service uptime during attacks.
Common Threats to Availability:
- Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) attacks designed to overwhelm systems.
- Ransomware: Encrypting systems and data to make them inaccessible until a ransom is paid.
- Physical or technical failures: Hardware failures, power outages, natural disasters, and human operational mistakes.

Incident Overview: A major security failure in $2017$ that compromised the confidentiality and availability of sensitive information for approximately $\approx 147 \text{ million Americans}$ .
The Confidentiality Failure:
- Vulnerability Exploitation: Hackers exploited a critical, known vulnerability in the Equifax web application.
- Data Compromised: Unauthorized access was gained to highly sensitive metrics, including Social Security Numbers ( $\text{SSN}$ ), exact dates of birth, physical addresses, and driver's license numbers.
- Consequences: The breach resulted in massive exposure, putting individuals at extreme risk of identity theft, fraud, and financial loss.
The Availability Crisis:
- Service Disruption: Following the public discovery of the breach, Equifax's internal systems, website, and customer service channels were overwhelmed by inquiries.
- Impact: This created significant disruptions for legitimate customers trying to access services, illustrating how a breach can lead to a secondary availability crisis.
Critical Operational Failures:
- Failure to adequately patch known software vulnerabilities.
- Lack of strong access controls.
- Inadequate system monitoring, which allowed the breach to occur and persist.

Prioritize the Triad: Organizations must understand the severe consequences of failing to prioritize confidentiality and availability.
Investment in Proactive Security: It is mandatory to invest in robust security measures, specifically:
- Regular and rigorous vulnerability assessments.
- Timely and consistent software patching.
- The implementation of strong access controls to prevent unauthorized data access.
Incident Response Planning: A comprehensive, well-documented incident response plan is vital for minimizing breach impact and ensuring the continued availability of critical services during a crisis.