Introduction to Cybersecurity and a remote guide

Cybersecurity roadmap for the student community.

1. Introduction to Cybersecurity: Foundations, Threats, and
Defenses
By Dnyaneshwar Shelke, CDSC Team
October 23, 2025

2. 1 Introduction
The contemporary world is intrinsically linked to the digital domain, making information the
most valuable commodity. As society continues its rapid migration to cloud services, inter-
connected devices, and digital transaction systems, the imperative for robust cybersecurity
measures has never been greater. Cybersecurity, in its essence, is the practice of protecting
systems, networks, and programs from digital attacks. These cyberattacks are typically aimed
at accessing, changing, or destroying sensitive information, extorting money from users, or
interrupting normal business processes.
The importance of cybersecurity in the digital era stems directly from our reliance on tech-
nology. Critical infrastructure, including power grids, financial markets, and healthcare sys-
tems, is managed by networked computers, and the compromise of any one system can have
catastrophic real-world consequences. Personal data, intellectual property, and governmen-
tal secrets are all stored and transmitted digitally, making their protection a matter of national
and economic security.
A foundational understanding of cybersecurity requires an appreciation of the real-world
controls deployed to mitigate risk. A relevant example is a major financial institution, such as
a bank, implementingMulti-Factor Authentication (MFA)for all online banking accounts.
This simple addition moves beyond requiring just a password (something the user *knows*)
to requiring a second factor, such as a one-time code generated on a mobile device (something
the user *has*). By layering this control, the bank drastically reduces the probability of unau-
thorized account access, even if a user’s primary password is stolen through a data breach or
phishing attack. This illustrates cybersecurity as a proactive, layered discipline designed to
maintain trust and functionality in digital systems.
User Tries to Log InPassword Check (Knowledge)OTP/Token Check (Possession)Access GrantedStep 1: SuccessfulStep 2: SuccessfulStep 3: Successful
Figure 1: Diagram illustrating the layered steps of Multi-Factor Authentication (MFA).
2 The CIA Triad
The CIA Triad is the cornerstone of information security policy and strategy. It represents
three core security goals that organizations strive to achieve: Confidentiality, Integrity, and
Availability. These three principles are interdependent, and security measures are often eval-
uated based on how well they support each component.
ConfidentialityIntegrityAvailabilityThe intersection
is theGoalof In-
formation Security
Figure 2: The CIA Triad: The Fundamental Goals of Information Security.
1

3. 2.1 Confidentiality
Confidentiality ensures that information is accessible only to those parties authorized to have
access. Protecting information from unauthorized disclosure is critical for privacy and com-
petitive advantage. The focus here is on preventing the unauthorized viewing or reading of
sensitive data, both while it is stored and while it is in transit.
Mechanisms used to enforce confidentiality include data encryption, access control lists
(ACLs), and strong authentication methods. For instance,Encrypted Emailsserve as a prime
example of confidentiality in practice. By encrypting the message content, only the sender
and the intended recipient, who holds the necessary decryption key, can read the informa-
tion. If the email is intercepted by a malicious third party, the data remains scrambled and
unreadable, thereby preserving its confidentiality.
Sender (Plain Text)Encrypt (Key)Cipher Text (Unreadable)Decrypt (Key)Receiver (Plain Text)
Figure 3: Confidentiality enforced through Encryption.
2.2 Integrity
Integrity ensures that data is accurate, consistent, and trustworthy throughout its entire life-
cycle. This principle requires that data cannot be modified, deleted, or otherwise tampered
with by unauthorized parties. If data is modified, mechanisms must be in place to detect the
change and, ideally, restore the data to its authentic state.
The principle of integrity is fundamental to trust. A practical illustration isBlockchain
Transaction Verification. A blockchain uses cryptographic hashing to link blocks of data to-
gether. If a single transaction within a block is altered, the block’s hash changes, breaking the
chain’s integrity. The network of participants immediately detects this discrepancy, prevent-
ing the tampered data from being accepted as valid. This mathematical verification ensures
data consistency and trustworthiness.
Data AHashing FunctionOriginal Hash H1Data A (Accessed/Modified)Re-Hash & VerifyH1 = H2? (Integrity Check)
Figure 4: Integrity enforced through Hashing to detect tampering.
2.3 Availability
Availability guarantees that authorized users can reliably access information and resources
when they need them. Security is meaningless if the systems it protects are constantly down or
inaccessible. Threats to availability often take the form of power outages, hardware failures,
or Denial-of-Service (DoS) attacks.
2

4. Maintaining high availability requires redundancy, failover clustering, robust backup and
recovery plans, and sufficient bandwidth. A key example is the use ofCloud Redundancy in
services like Google Drive. Rather than storing a user’s file on a single server, cloud providers
duplicate the data across multiple geographically separated data centers. If one server or even
an entire data center fails, the system automatically redirects the user’s access request to an
operational copy, ensuring continuous availability of the data.
User RequestPrimary Server (Active)Secondary Server (Backup)Failure DetectedFailover Redirect
Figure 5: Availability maintained via Redundancy and Failover.
3 Common Cyber Threats
The threat landscape is constantly evolving, but several categories of attack remain consis-
tently common and dangerous. Understanding these threats is the first step in devising effec-
tive defense strategies.
Common Cyber ThreatsMalwarePhishingRansomwareVirus/WormTrojan/SpywareSpear PhishingVishing/SmishingCrypto LockerScreen Locker
Figure 6: Classification Tree of Common Cyber Threats
3.1 Malware
Malware (malicious software) is a catch-all term for any software intentionally designed to
cause damage to a computer, server, client, or computer network. Malware comes in many
forms, including viruses, worms, spyware, adware, and trojans.
A powerful historical example of malware is theWannaCry Ransomware Attack of May
2017. WannaCry was a crypto-worm that exploited a vulnerability in older Microsoft Windows
systems. It spread rapidly across internal networks and the public internet, encrypting files on
compromised computers and demanding a Bitcoin ransom for their release. The attack glob-
ally affected hundreds of thousands of computers, including those in the UK’s National Health
Service, causing massive operational disruption and highlighting the destructive potential of
rapidly propagating malware.
3

5. 3.2 Phishing
Phishing is a form of social engineering where an attacker attempts to trick an individual into
revealing sensitive information, often by masquerading as a trustworthy entity in an elec-
tronic communication (most commonly email). The goal is typically to capture credentials,
financial details, or deploy malware.
ClassicEmail Scams Targeting Employees are the most prevalent form of phishing. An
attacker might send an email that appears to be from a CEO or HR department, urging the
recipient to click a link to ”verify their password” or ”review a mandatory policy update.”
The link directs the employee to a fake login page that harvests their credentials, giving the
attacker access to the corporate network.
3.3 Ransomware
Ransomware is a specific, malicious type of malware that blocks access to a computer system
or encrypts data until a sum of money (the ransom) is paid to the attacker. It is often the most
visible and financially damaging form of attack.
TheColonial Pipeline Attackin May 2021 provided a stark illustration of ransomware’s
impact on critical infrastructure. A single compromised password allowed a ransomware
group to breach the company’s network and encrypt critical systems used for billing and re-
source management. While the operational technology (OT) systems controlling the flow of
gas were not directly encrypted, the company shut down the pipeline as a precautionary mea-
sure due to the inability to safely bill and manage the logistics. The resulting fuel shortages and
panic buying across the southeastern U.S. demonstrated how cyberattacks on digital systems
can generate significant physical and economic turmoil.
4 Social Engineering Attacks
Social engineering is the psychological manipulation of people into performing actions or di-
vulging confidential information. It is often considered the weakest link in the security chain
because it targets human error and trust, bypassing technological safeguards.
Attackers typically rely on four principles: authority (pretending to be management), in-
timidation (creating a sense of urgency or fear), consensus (claiming others have done it), and
scarcity (implying a limited-time opportunity).
4

6. Core Principles of Social Engineering
Principle Description
Authority The attacker pretends to be a person in
power (e.g., a CEO or IT administrator) to in-
duce compliance.
Intimidation Creating a sense of urgency, fear, or immedi-
acy to force the victim into quick, unthink-
ing action.
Consensus/So-
cial Proof
Claiming that colleagues or other trusted
groups have already performed the re-
quested action.
Scarcity Implying that the opportunity or access is
limited-time, thus compelling the victim to
act quickly.
Attacker (Pretext)Victim (Help Desk)Action: Password ResetAccess GrantedCall: ”Lost ID Badge”Believes StoryUnintended Consequence
Figure 7: Social Engineering (Pretexting) Flow.
Pretextingis a form of social engineering where an attacker creates an invented scenario
(pretext) to engage a victim and gather information. An attacker might call a corporate help
desk, claiming to be a distressed employee who lost their ID badge, and use that pretext to
convince the staff member to reset the ”employee’s” password.
Baitinginvolves tempting victims with a tangible or digital offering. A classic baiting attack
involves leaving a malware-infected USB flash drive in a public space, labeled with something
enticing like “2025 Salary Information.” An unsuspecting employee might plug the drive into
their work computer out of curiosity, unknowingly installing malicious software. These at-
tacks rely purely on human curiosity and helpfulness, making awareness training a primary
defense.
5 Domains of Cybersecurity
Cybersecurity is not a single tool or defense layer; it is an umbrella term covering several
specialized domains, each focusing on protecting a different part of the IT ecosystem.
5

7. Cybersecurity Domain Summary
Domain Primary Focus Key Control Example
Network Secu-
rity
Protecting data flow
and infrastructure
perimeter.
Firewalls, Intrusion Detec-
tion Systems (IDS) at enter-
prises.
Application Se-
curity
Securing software
and APIs against ex-
ploitation.
Secure coding practices,
vulnerability testing in
banks.
Cloud SecurityProtecting data and
resources hosted in
cloud environments
(e.g., AWS, Azure).
Encryption of data at rest
and in transit.
Endpoint Secu-
rity
Protecting final ac-
cess devices (laptops,
desktops, phones)
and their data.
Antivirus/EDR software in
corporate laptops.
5.1 Network Security
Network security focuses on protecting the underlying infrastructure and all data that flows
across it. This includes hardware like routers, switches, and the software that manages net-
work traffic. The goal is to prevent unauthorized intruders from accessing the network and
block various forms of malicious traffic.
A critical example is the deployment ofFirewalls at Enterprises. A firewall acts as a dig-
ital traffic cop, sitting at the perimeter of a network. It uses a set of defined rules to analyze
incoming and outgoing packets, blocking traffic from untrusted sources while permitting au-
thorized traffic.
Internet (Untrusted)Firewall (Rules)Internal Network (Trusted)Traffic RequestAllowed TrafficMalicious TrafficBLOCKED
Figure 8: Network Security: Firewall at the Perimeter.
6

8. 5.2 Application Security
Application security focuses on securing software and systems against external threats. This
begins during the application’s design phase and extends throughout its entire lifecycle. The
goal is to prevent flaws in the software itself that could be exploited by attackers.
A key practice in banks and financial technology firms is adhering toSecure Coding Prac-
tices. Developers are trained to avoid common vulnerabilities like SQL injection or cross-site
scripting (XSS). Regular security testing, code reviews, and penetration testing are employed
to identify and remediate security bugs before the application is deployed to users.
5.3 Cloud Security
Cloud security is the practice of protecting data, applications, and infrastructure hosted in the
cloud computing environment (e.g., AWS, Azure, Google Cloud). This is a shared responsibility
between the cloud provider and the customer.
A primary technique is theEncryption of AWS Data. Customers use services provided by
Amazon Web Services (AWS) to automatically encrypt their data both in transit (using proto-
cols like TLS/SSL) and at rest (stored on disks). This ensures that even if an attacker were to
breach the underlying infrastructure, the harvested data would be unreadable without the
proper keys, thus maintaining confidentiality.
5.4 Endpoint Security
Endpoint security refers to the practice of protecting the final destination devices (endpoints)
that access an organization’s network, such as laptops, desktops, and mobile phones. Since
these devices are often outside the secure perimeter, they represent a significant attack vector.
The most common defense mechanism is the use ofAntivirus and Endpoint Detection
and Response (EDR) in Corporate Laptops. EDR software continuously monitors the laptop
for malicious activity, not just by looking for known virus signatures, but by analyzing behav-
ior. If it detects suspicious processes or attempts to encrypt files, it can automatically isolate
the laptop from the corporate network, preventing lateral movement of the threat.
6 Core Cybersecurity Principles
Effective cybersecurity is built upon fundamental principles that guide policy creation and
system architecture. Two of the most important are the Principle of Least Privilege and De-
fense in Depth.
6.1 Principle of Least Privilege (PoLP)
The Principle of Least Privilege dictates that any user, program, or process should have only
the bare minimum permissions necessary to perform its required functions and no more. This
is a fundamental concept for minimizing the risk associated with compromised accounts.
The application of PoLP is best seen inEmployee Role-Based Access. A marketing assis-
tant, for example, needs access to campaign metrics and content management systems, but
they do not need access to the company’s main financial ledgers or server configuration files.
By assigning permissions strictly based on their job role, a successful phishing attack against
the marketing assistant will only grant the attacker access to a limited scope of data, severely
limiting the damage they can inflict.
7

9. Employee (Role)Marketing RoleFinance RoleCampaign Access (Allowed)Server Config (Denied)Campaign Access (Denied)Financial Ledgers (Allowed)
Figure 9: Principle of Least Privilege (PoLP) enforced by Role-Based Access.
6.2 Defense in Depth
Defense in Depth (DiD) is a strategy that employs a series of security mechanisms, tools, and
processes across multiple layers to protect against threats. The philosophy is that if one layer
of security fails, another will be ready to take its place. It avoids relying on a single control
point for security.
Data/Asset3. Endpoint Security (EDR/Antivirus)2. Internal Network Segmentation1. Perimeter (Firewall/IPS)Attacker must bypass mul-
tiple independent layers
to reach the core asset.
Figure 10: Defense in Depth (DiD) - A layered security strategy.
In practice, DiD is implemented asLayered Security at Corporate Offices. This can in-
volve:
1.Perimeter Layer:A firewall and intrusion prevention system (IPS) block malicious traf-
fic.
2.Network Layer:Internal network segmentation separates the production servers from
the employee workstation network.
3.Endpoint Layer:EDR software and strong passwords protect individual user devices.
4.Data Layer:Encryption protects the data itself, even if the surrounding systems are
breached.
If an attacker manages to bypass the perimeter firewall, the internal network segmentation
and endpoint security controls provide further obstacles, making the attack exponentially
more difficult to execute.
8

10. 7 Conclusion
Cybersecurity is not merely a technical specialty reserved for IT professionals, but a dynamic,
multifaceted discipline essential for survival in the digital age. The successful protection of
data relies on the foundational principles of the CIA Triad—Confidentiality, Integrity, and
Availability—which define the goals of all security programs.
We have explored the persistent threats, including Malware (e.g., WannaCry), Phishing,
and Ransomware (e.g., Colonial Pipeline), and noted how human vulnerabilities are exploited
through Social Engineering attacks like pretexting and baiting. Furthermore, effective defense
requires specialized efforts across different domains, from Network and Application Security
to Cloud and Endpoint protections. These efforts are unified by core principles like Least Priv-
ilege and Defense in Depth, which mandate minimal access rights and layered protection.
The future of cybersecurity is a constant arms race. While technology will continue to ad-
vance, the most critical element remainsuser awareness. By summarizing these key concepts
and understanding the real-world relevance of every security decision, individuals and orga-
nizations alike can build a resilient defense against the inevitable and evolving threats of the
digital world.
9