Skip to main content

Preview build: sign-in and grading run on the server. MFA is not enabled, and storage is in server memory so it does not survive a restart.

LearnDefend
Digital & Cybersecurity Foundations
TheoryTutorial14 minIncident Triage

The Digital Environment

What is it?

A digital environment is every device, application, network, dataset, identity, person and process an organization relies on — and the trust relationships and dependencies that connect them.

Why it matters

You cannot protect what you cannot picture. Analysts who see the whole environment catch risks that analysts who only see 'the computer' miss.

Where you see it

In an asset inventory, a network diagram, or simply by asking 'what would break, and who would be affected, if this stopped working?'

What normal looks like

A clear, current map of what exists: which laptops, which applications, which accounts, and how they depend on each other.

What suspicious looks like

An asset nobody remembers owning, an account with access nobody can explain, or a trust relationship (an app trusting an account, a service trusting another service) that was never reviewed.

How analysts investigate

Start from the affected asset, then trace its dependencies and trust relationships outward — what does it talk to, what talks to it, and who is allowed to touch it.

Common beginner mistakes

  • Thinking of 'the network' as just wires and Wi-Fi, and forgetting that identities and processes are part of the environment too.
  • Assuming an outage with no data theft is not a security matter — availability is part of security too.

NovaCore is a fictional mid-size company. Before we talk about attacks, ask a more basic question: what does NovaCore actually need to protect?

NovaCore's digital environment
InternetPublic WebsiteCloud ServicesFirewallCorporate NetworkEmployeeLaptopServerWi-FiEmail& IdentityCustomerDatabase
The internet reaches NovaCore through a firewall into the corporate network, which connects laptops, servers, Wi-Fi, email & identity, and the customer database.

Every box in that picture is an Asset, and every line is a relationship that has to be trusted correctly. Assets group into a few recognizable categories:

Asset categories
OrganizationDevicesLaptop · Server · MobileApplicationsEmail · Browser · ERPNetworksLAN · Wi-Fi · InternetDataFiles · Credentials · RecordsPeopleEmployees · Admins · CustomersProcessesLogin · Backup · Response
Devices, applications, networks, data, people and processes — cybersecurity protects all six, not just the devices.

Quick check

An employee's account has no physical form. Is it still an asset?

A quick self-check — it doesn't affect your XP or progress.

How a compromise moves through the environment

A basic attack path
1Entry PointCompromised identity2TrustCorporate email3AccessCloud application4TargetCustomer records
A compromised identity is an entry point; trust in that identity gives access; access reaches the real target.

Quick check

NovaCore's customer portal is knocked offline by a flood of junk traffic — nothing is stolen. Is this a cybersecurity incident?

A quick self-check — it doesn't affect your XP or progress.

Following the trust, not the wires

Look again at NovaCore's environment diagram: internet → firewall → corporate network → laptops, servers, Wi-Fi, email & identity, customer database. Trace how one phished identity becomes access to the customer database.

  1. Identify the entry point as an asset, not a wire.

    The attacker does not cut a cable — they compromise an identity (the phished account). A beginner pictures 'the network' as Wi-Fi and switches and misses that the identity IS part of the environment, and is the actual door.

  2. Walk the trust relationships outward.

    That identity is trusted by email (so the attacker reads mail), and — because the account has access — trusted by the customer database. Each line in the diagram is a trust relationship, and the attacker travels along the ones nobody re-checked. The firewall never mattered here; the trust did.

  3. Spot the availability angle too.

    Even if nothing is stolen, the same environment view shows another failure mode: flood the customer portal with junk traffic and it goes offline. No data leaves, yet an asset (the portal, and the business it carries) is harmed. Seeing the whole environment is what lets you count that as an incident, not dismiss it as 'just IT'.

Sign in to save your progress on the server.