Introduction to Cybersecurity
What is it?
Cybersecurity is the technologies, processes, practices and behaviors used to protect systems, networks, applications, data and users from unauthorized access, disruption, theft or misuse.
Why it matters
Cybersecurity is much more than antivirus or a firewall. A digital environment is made of many interconnected components, and a weakness in just one of them can give an attacker a path to the rest.
Where you see it
Everywhere a digital environment has value: devices, applications, networks, data, the people who use them, and the everyday processes — login, backup, payment, incident response — that keep an organization running.
What normal looks like
An employee receives a legitimate email, opens a real login page, signs in once with the right credentials, and gets on with their work — nothing about the exchange asks them to rush or panic.
What suspicious looks like
A message that creates urgency ('sign in now or your account is suspended'), a login page that looks almost right, and — shortly after — a sign-in from a place or time that does not match the employee's normal pattern.
How analysts investigate
A defender does not start with the attack — they start by protecting and monitoring the environment, so that when something suspicious happens they can detect it, investigate what occurred, respond, and recover.
Common beginner mistakes
- Assuming cybersecurity means 'having antivirus installed' rather than protecting an entire interconnected environment.
- Jumping straight to 'how was it attacked?' before asking 'what were we protecting in the first place?'
It is 8:17 AM. An employee in the finance department opens their inbox and sees what appears to be a Microsoft security message: "Your password has expired. Sign in now to avoid account suspension." They click the link. A familiar-looking login page appears. They enter their email and password. The page returns an error.
Minutes later, someone logs into the employee's account from an unusual IP address and begins attempting to access company files.
What is Cybersecurity?
Cybersecurity is the collection of technologies, processes, practices, and behaviors used to protect systems, networks, applications, data, and users from unauthorized access, disruption, theft, or misuse.
What are we protecting? (Asset)
Anything that has value to a person or an organization can be considered an Asset.
| Asset | Example |
|---|---|
| Data | Customer records |
| Account | A Microsoft 365 account |
| Device | An employee's laptop |
| Server | A web server |
| Application | An HR system |
| Network | The company network |
| Reputation | The organization's reputation |
Who threatens these assets?
- Cybercriminal
- Insider
- Hacktivist
- State-sponsored actor
- Competitor
- Opportunistic attacker
Where does defense happen?
- Email security
- Employee awareness
- Multi-factor authentication (MFA)
- Conditional access
- Monitoring
- SOC alert
Quick check
In the earlier scenario, which asset did the attacker initially target?
A quick self-check — it doesn't affect your XP or progress.
What does a defender do?
This is the learner's first link between Cybersecurity and the SOC work that follows in later modules.
Quick check
A small company has 50 employees, Windows devices, Wi-Fi, corporate email, a customer database, and a website. How many of these should be treated as assets requiring protection?
A quick self-check — it doesn't affect your XP or progress.
Summary
- People, Devices, Applications, Networks, Data, Processes — this is what Cybersecurity protects.
| Term | Meaning |
|---|---|
| Asset | Something of value. |
| Threat | Something that could cause harm. |
| Attacker | An entity attempting unauthorized access, disruption, theft, or misuse. |
| Defender | A person or system responsible for protecting, detecting, investigating, and responding. |
Where did the failure begin?
Return to the 8:17 AM scenario — the finance employee, the fake Microsoft message, the login page, the error, then the stranger logging in. Reason about it the way a defender does, asset-first.
Ask 'what were we protecting?' before 'how was it attacked?'
A tempting first reaction is to hunt the fake website or blame the employee. But start with the asset: the fake page was collecting the employee's credentials. Credentials are the asset here — and they are valuable precisely because they unlock other assets (email, files, systems).
Trace the harm to the environment, not one box.
The error page was not a failure — it was the credentials being captured. Minutes later the stranger logs in from an unusual IP and reaches company files. No antivirus or firewall was 'broken'; the path ran through email → a person → a fake page → an identity → the real target. The environment, not any single device, was the battlefield.
State where defense should have layered in.
Because the asset was an identity, the defenses that matter are identity-shaped: MFA (so a stolen password alone is not enough), monitoring (to catch the login from an unusual place), and awareness (so the employee doubts the urgent message). Naming the asset first is what points you at the right defenses instead of guessing.
Sign in to save your progress on the server.