Mastering Security Fundamentals: A Comprehensive Guide to Cybersecurity Basics

Reading time: 4 min · 895 words

This comprehensive guide covers core cybersecurity concepts including the CIA triad, threat vs vulnerability, authentication vs authorization, hashing vs encryption, malware types, and defense strategies. Learn with practical examples and interview-ready explanations.

Mastering Security Fundamentals: A Comprehensive Guide to Cybersecurity Basics

Image credit: Wikimedia Commons

Table of Contents

Core Security Concepts

The foundation of cybersecurity begins with understanding three fundamental principles:

The CIA Triad

graph TD
    A[CIA Triad] --> B[Confidentiality]
    A --> C[Integrity]
    A --> D[Availability]
  • Confidentiality: Ensures data is accessible only to authorized individuals
  • Example: HR payroll files visible only to HR personnel

  • Controls: Access control, encryption, data classification

  • Integrity: Maintains accuracy and consistency of data

  • Example: Preventing unauthorized changes to bank account details

  • Controls: Hashing, digital signatures, change control

  • Availability: Guarantees systems and data are accessible when needed

  • Example: Ensuring website uptime during business hours
  • Controls: Redundancy, failover systems, disaster recovery

Key Note: The CIA triad forms the basis for all security controls - every security measure should protect at least one aspect of the triad.

Threat, Vulnerability, and Risk

Concept Definition Example
Threat Potential cause of harm Cybercriminal, ransomware
Vulnerability Weakness that can be exploited Unpatched server, weak passwords
Risk Likelihood and impact of threat exploiting vulnerability Data breach leading to financial loss

Real-world scenario: An internet-facing server with outdated software: - Threat: Cybercriminal - Vulnerability: Outdated software - Risk: Server compromise exposing customer data - Controls: Patching, WAF, network segmentation

Access Control Fundamentals

Authentication vs Authorization

  1. Authentication verifies identity using: - Something you know (password) - Something you have (security token) - Something you are (biometrics)

  2. Authorization determines access rights after authentication: - Role-Based Access Control (RBAC) - Attribute-Based Access Control (ABAC) - Principle of least privilege

sequenceDiagram
    User->>System: Requests access
    System->>User: Requests credentials (Authentication)
    User->>System: Provides credentials
    System->>System: Verifies identity
    System->>User: Grants access (Authorization)
    User->>System: Requests resource
    System->>System: Checks permissions
    System->>User: Allows/Denies access

Data Protection Methods

Hashing vs Encryption

Feature Hashing Encryption
Purpose Data integrity verification Data confidentiality
Reversibility One-way process Reversible with key
Key Usage No keys (uses salt) Requires key
Common Uses Password storage, file verification Secure communications, data at rest

Best practice: Always use salted, slow hashing algorithms (like bcrypt) for password storage.

Common Attack Vectors

Malware Types

  1. Virus: Attaches to files, requires user action to spread
  2. Worm: Self-replicating, spreads without user interaction
  3. Trojan: Disguised as legitimate software
  4. Ransomware: Encrypts data for extortion
  5. Spyware: Secretly monitors user activity
  6. Rootkit: Maintains privileged access while hiding
  7. Botnet: Network of compromised devices

Phishing Techniques

  • Spear phishing: Targeted at specific individuals
  • Whaling: Targets high-profile executives
  • Smishing: Phishing via SMS
  • Vishing: Phishing via voice calls

Red flags to spot phishing: - Urgent or threatening language - Mismatched sender addresses - Suspicious links or attachments - Requests for sensitive information

Credential Attacks

Brute Force vs Password Spraying

Attack Type Method Prevention
Brute Force Many passwords against one account Account lockout, MFA
Password Spraying Few common passwords across many accounts Banned password lists, smart detection

Post-Compromise Activities

Privilege Escalation

  • Vertical: Gaining higher privileges (user → admin)
  • Horizontal: Accessing other accounts at same level

Data Exfiltration

Signs of data exfiltration: - Large data transfers to external locations - Unusual compression activities - Connections to unknown cloud services

Detection and Analysis

Indicators of Compromise (IOC) vs Indicators of Attack (IOA)

IOC Examples IOA Examples
Known malicious file hashes PowerShell downloading code
Suspicious IP addresses Security tools being disabled
Malicious domains Mass file encryption

Alert Types

pie title Alert Types
    "True Positive" : 40
    "False Positive" : 30
    "True Negative" : 20
    "False Negative" : 10
  • False positive: Legitimate activity flagged as malicious
  • False negative: Malicious activity not detected

Critical Consideration: While false positives waste analyst time, false negatives allow attacks to proceed undetected - requiring careful balance in detection tuning.

Practical Investigation Scenarios

  1. Phishing Incident: User opens macro-enabled file triggering PowerShell download - Initial access: Phishing - Delivery: Trojan document - IOA: PowerShell process chain

  2. Brute Force Attempt: 5,000 failed logins to admin account - Check for eventual success - Review MFA prompts - Investigate source IP reputation

  3. Data Exfiltration: Service account uploading large data volumes to unknown cloud domain - Validate authorization - Contain the account - Assess data exposure

Key Security Controls

  1. Implement multi-factor authentication (MFA)
  2. Enforce principle of least privilege
  3. Maintain regular patching schedule
  4. Deploy endpoint detection and response (EDR) solutions
  5. Conduct security awareness training
  6. Implement data loss prevention (DLP) controls
  7. Monitor for unusual authentication patterns
  8. Establish incident response procedures

Interview Preparation Tips

When explaining security concepts: 1. Provide clear definition 2. Give practical example 3. Explain security impact 4. Mention relevant controls

For example, when asked about the CIA triad: - Define each component (Confidentiality, Integrity, Availability) - Example: Online banking system - Confidentiality: Account details visible only to owner - Integrity: Preventing unauthorized balance changes - Availability: Ensuring 24/7 access to banking services - Explain business impact if any component fails - Mention controls like encryption, hashing, and redundancy

Frequently Asked Questions

Q: What's the difference between authentication and authorization?

A: Authentication verifies identity (who you are), while authorization determines access rights (what you're allowed to do). Authentication comes first, then authorization follows.

Q: Why should passwords be hashed rather than encrypted?

A: Hashing is one-way, making it safer for password storage - even if the database is compromised, attackers can't reverse the hashes. Encryption is reversible, creating potential exposure if keys are compromised.

Q: How does password spraying differ from brute force attacks?

A: Brute force tries many passwords against one account, while password spraying tries a few common passwords across many accounts to avoid lockouts.

Key Takeaways

  • The CIA triad (Confidentiality, Integrity, Availability) forms the foundation of all security controls
  • Authentication verifies identity while authorization controls access permissions
  • Hashing provides integrity verification while encryption ensures confidentiality
  • Different attack types require specific defenses (MFA for brute force, banned password lists for spraying)
  • Monitor for both IOCs (evidence of compromise) and IOAs (suspicious behaviors)
  • Balance detection tuning to minimize both false positives and false negatives
  • network-security-basics
  • incident-response-process

Comments

Post a Comment

Popular Posts

CORS Explained: The Complete Guide to Cross-Origin Resource Sharing, Preflight Requests and Secure API Access

Image
Somewhere in your browser console you will find a wall of text like this: Access to fetch at 'https://api.example.com/v1/orders' from origin 'https://app.example.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. It looks like a server bug. It is not. It is a browser doing what it was designed to do: refusing to hand a response from one origin to a page loaded from another. Behind that red text is a small set of rules, a handful of HTTP headers, and one architectural decision — proxy or allow — that shapes how your frontend talks to your backend. This guide covers what an origin actually is, when the browser sends a preflight, which headers decide the outcome, how credentials change the rules, how to configure CORS in common stacks, and how to avoid CORS entirely with a proxy. Table of Contents What Is Cross-Origin Resourc...
Read more

Kubernetes Gateway API: The Future of Ingress and Service Mesh Routing

Image
Introduction For years, the Kubernetes Ingress API has served as the de facto standard for exposing HTTP and HTTPS traffic to services running inside a cluster. While simple to use, the Ingress API has long suffered from limitations. It is largely HTTP-focused, lacks expressiveness for advanced routing, and relies heavily on vendor-specific annotations to unlock critical features. This creates portability issues and makes configurations difficult to standardize across environments. Enter the Kubernetes Gateway API . Developed by the Kubernetes SIG-Network community, Gateway API is a next-generation, role-oriented, and extensible API for modeling service networking. It is designed to be more powerful than Ingress, support multiple protocols beyond HTTP, and cleanly separate responsibilities between different personas such as cluster operators, platform teams, and application developers. In this article, we will explore the motivation behind Gateway API, its core concepts, how it co...
Read more

SQLite Explained: Why the World's Most Deployed Database Powers Modern Apps

Image
There is a good chance you interacted with SQLite several times today — before your first cup of coffee. Every iPhone, every Android device, most browsers, most laptops, and a huge share of embedded systems ship with an SQLite database inside. By the project's own count, it is deployed on more than one trillion databases. Yet in engineering interviews and architecture discussions, SQLite is often waved away as "just a toy database" that you outgrow the moment you need a real server. That reputation is outdated. Over the last decade SQLite has quietly evolved into a serious storage engine: it powers serverless edge applications, runs inside WebAssembly in the browser, underpins major mobile and desktop software, and serves as the primary database for an entire generation of small-to-medium web services — often with replication tools that make it behave far more capable than its file-based roots suggest. This article explains what SQLite actually is, how it works under ...
Read more