What Is Cybersecurity? — Cybersecurity Fundamentals

What Cybersecurity Really Means

Cybersecurity is the discipline of protecting computer systems, networks, devices, and data from unauthorized access, theft, alteration, and destruction. It is not just about installing an antivirus or a firewall: it is a combination of practices, technologies, and processes working together to preserve trust in the digital systems we use every day.

Think of an everyday example. When you use online banking, you trust that no one else can see your balance (unauthorized access), that no one can change the amount of a transfer in transit (alteration), and that the application works when you need it (destruction or service disruption). Behind that seemingly simple experience there is encryption, access control, constant monitoring, backups, and teams of people responding to incidents. Cybersecurity is all of that working at once.

In a world where nearly all economic, social, and governmental activity depends on technology, cybersecurity has stopped being a concern exclusive to IT departments and has become a shared responsibility. From the user who chooses a strong password to the engineer who designs a secure architecture, everyone is part of the chain of defense.

This is especially true in Latin America, where thousands of small and medium-sized businesses digitized their operations in just a few years: electronic invoicing, sales over WhatsApp, payments through digital wallets, spreadsheets in the cloud. Each of those advances brings enormous benefits, but it also enlarges what professionals call the attack surface: the set of points through which an attacker could try to get in. A hardware store that used to have only a cash register now has an online billing system, corporate email, and customer data — and all of those assets need protection.

It is important to understand that perfect security does not exist. The goal is not to make a system invulnerable —something impossible in practice— but to manage risk intelligently: reduce the likelihood of an incident and limit its impact when one occurs. A good security professional does not promise "we will never be attacked"; they promise "we will make the attack harder, detect it quickly, and recover with as little damage as possible."

It is also worth dispelling a myth right from the start: cybersecurity is not a product you buy once, it is a continuous process. Threats evolve, software changes, people move between roles. What is secure today can stop being secure tomorrow if nobody maintains it.

The CIA Triad: Confidentiality, Integrity, and Availability

The foundational model of information security is the CIA triad: Confidentiality, Integrity, and Availability. These three pillars define what it means for information to be protected. Practically every security control you will study in this course exists to defend one or more of these pillars.

Confidentiality

Confidentiality ensures that information is only accessible to those authorized to see it. When we encrypt a message, require a password, or apply access controls, we are protecting confidentiality. A data breach of personal records is, above all, a violation of confidentiality.

Everyday examples: the sealed envelope of a letter, the PIN of your debit card, the medical record that only your doctor can consult. In the digital world, the equivalent mechanisms are encryption (which makes data unreadable without the right key), authentication (verifying who you are), and access permissions (defining what each role can see). When you read in the news that "the data of millions of a company's customers was leaked," this is the pillar that failed.

Integrity

Integrity ensures that data is not modified in an unauthorized or accidental way. If an attacker alters a bank account balance or changes the contents of a contract, they are attacking integrity. Mechanisms such as cryptographic hashes (for example SHA-256) and digital signatures let us detect tampering.

A hash works like a "fingerprint" of a file: any change, however small —a comma, a single byte— produces a completely different fingerprint. That is why many download sites publish the hash of the original file: if the hash of what you downloaded does not match, the file was altered or corrupted along the way. Integrity is also protected with more mundane controls: audit logs (who changed what, and when?), restricted write permissions, and input validation.

Note that integrity also covers accidental errors: an employee who overwrites the wrong spreadsheet damages integrity just as much as an attacker does, even without malice. That is why integrity controls protect against both scenarios.

Availability

Availability ensures that systems and data are accessible when they are needed. A denial-of-service (DoS) attack that takes down a website attacks availability. Backups, redundancy, and disaster recovery plans exist to protect it.

This pillar tends to be underestimated until it fails. If a store's billing system goes down on a busy payday Friday, the business loses real sales even though no data was stolen or altered. Availability is defended with redundancy (duplicated servers and links), tested backups, preventive maintenance, and contingency plans — and not only against attackers: a prolonged power outage or a flood is also a threat to availability.

The Three Pillars Together

| Pillar | Question it answers | Typical attack | Typical control | |---|---|---|---| | Confidentiality | Can only authorized people see the information? | Data breaches, espionage, credential theft | Encryption, authentication, access control | | Integrity | Is the information accurate and unaltered? | Record tampering, fraud, file manipulation | Hashes, digital signatures, audit logs | | Availability | Is the information accessible when needed? | Denial of service (DoS), ransomware, sabotage | Redundancy, backups, recovery plans |

One detail that separates the professional from the amateur: the three pillars sometimes pull against each other. Encrypting everything with strict controls improves confidentiality, but it can hurt availability (if you lose the key, you lose access). Requiring triple approval for every change protects integrity, but slows the system down. Good security does not blindly maximize one pillar: it seeks the right balance for each context.

Beyond the Triad

Some authors add two complementary properties worth knowing. Authenticity guarantees that information comes from whoever claims to have sent it: a digitally signed email proves its author sent it and not an impostor. Non-repudiation prevents someone from denying an action they performed: whoever digitally signed a transaction cannot later disown it. Both properties rely on the cryptography we will study later in the course.

For this course, the CIA triad is enough of a compass: whenever you analyze any incident or security control, always ask yourself which of the pillars is at stake. That simple habit organizes your reasoning far better than memorizing lists of technologies.

Risk, Threat, and Vulnerability

These three terms are often confused, but they have precise meanings. Telling them apart is fundamental, because each one is managed differently.

A vulnerability is a weakness in a system: unpatched software, a weak password, a misconfiguration. It is the door that could be exploited. Known software vulnerabilities are publicly catalogued with CVE (Common Vulnerabilities and Exposures) identifiers, which lets security teams know exactly what they need to fix. But not all vulnerabilities are technical: an untrained employee or a missing procedure is also a weakness.

A threat is any circumstance or actor with the potential to cause harm by exploiting a vulnerability. An attacker, a piece of malware, or even a careless employee are threats. The threat is the agent that could walk through that door. It is important to note that threats are mostly outside your control: you cannot stop criminals from existing, but you can control your vulnerabilities.

Risk is the combination of both: the probability that a threat will exploit a vulnerability, multiplied by the impact it would have. It is often expressed as Risk = Threat × Vulnerability × Impact. A vulnerability with no real threats, or a threat with no vulnerabilities to exploit, represents little risk.

A useful analogy is a house:

| Concept | In the house analogy | In a computer system | |---|---|---| | Vulnerability | A window that does not close properly | An unpatched server | | Threat | The burglars operating in the neighborhood | Ransomware groups active in the region | | Impact | The value of what is inside | Customer data, business continuity | | Risk | Probability of burglary × value of the loss | Probability of incident × cost of the incident |

Let's look at a concrete case. A mid-sized distributor uses a management system accessed via remote desktop from the Internet, with the password "admin2020" and no second factor. The vulnerability is that combination of exposed service and weak credential. The threat is the criminal groups that automatically scan the Internet looking for exactly that kind of access (something that happens every day). The impact would be the encryption of the entire operation by ransomware: days without invoicing, customers left unserved. The resulting risk is extremely high — and the remarkable thing is that it drops dramatically with two inexpensive measures: a strong password and multi-factor authentication.

Thinking in Terms of Risk Management

Practical cybersecurity is about prioritization. No organization has infinite resources, so we must focus our defenses where they matter most. This is achieved through risk assessment: identifying valuable assets, the threats they face, and the vulnerabilities that could be exploited.

The process, simplified, follows these steps:

Inventory your assets: what do we have that is worth protecting? Customer data, billing systems, intellectual property, the company's very reputation.
Identify threats and vulnerabilities: who could attack us and through where? What known weaknesses do we have?
Estimate likelihood and impact: mathematical precision is not required; high/medium/low scales are already enough to prioritize.
Decide what to do with each risk and document the decision.
Review periodically, because the business and the threats keep changing.

Once a risk is identified, there are four classic strategies to treat it:

| Strategy | What it means | Concrete example | |---|---|---| | Mitigate | Reduce the probability or the impact with controls | Enable MFA, install patches, train the staff | | Transfer | Shift part of the cost to a third party | Buy cyber insurance or delegate to a specialized provider | | Accept | Live with the risk consciously and document it | A minor internal system whose fix costs more than the possible damage | | Avoid | Eliminate the activity that generates the risk | Do not store card numbers if you can use a payment gateway |

No strategy is "the right one" in the abstract: the choice depends on the asset, the cost of the control, and the organization's risk appetite. The only unacceptable option is the unofficial fifth one: ignoring the risk without ever having assessed it.

From this mindset also comes the principle of defense in depth: since any individual control can fail, several layers are stacked —prevention, detection, response, and recovery— so that the failure of one does not mean the collapse of everything. We will see it materialize throughout the course.

People, Processes, and Technology

Another frequent mistake is thinking about cybersecurity only in terms of tools. Professional frameworks insist that every defense stands on three legs, and the weakest one sets the height of the whole:

People: the team's training and habits. The most expensive firewall is useless if someone hands over their password on the phone. Periodic awareness training —short, practical, jargon-free— is one of the most profitable investments there is.
Processes: the written rules for how things get done. Who approves a transfer? How is a departing employee's access removed? Who gets notified when an incident is suspected? Without processes, every emergency is improvised.
Technology: the technical controls — antivirus, firewalls, encryption, backups. They are indispensable, but they only pay off when they serve the other two pillars.

A small business on a tight budget can achieve a respectable security posture by working on the two inexpensive legs first: training its people and putting its processes in order. Sophisticated technology comes later, once there is a foundation capable of making use of it.

Common Beginner Mistakes

Believing "nobody will attack me because I'm small": most attacks are automated and massive; the bots scanning the Internet do not distinguish between a multinational and a neighborhood shop.
Confusing security with a product: buying an antivirus and considering yourself protected. Tools help, but without processes and habits they are not enough.
Chasing invulnerability: spending the entire budget on a single perfect control instead of reasonably covering several fronts.
Protecting everything equally: if everything is a priority, nothing is. The customer list and the corporate wallpaper do not deserve the same effort.
Assessing risk only once: risk assessments expire, like food. A new system, a departing employee, or an emerging threat makes them outdated.

Exercise: Your First Risk Assessment

You do not need a company to practice: your own digital life works as a lab. Take pen and paper —or a blank document— and answer in order:

Assets: what are your five most valuable digital assets? Think of your main email account, your online banking, your family photos, your work documents, your social media.
Threats: what could damage each one? Account takeover, a lost phone, ransomware, your own carelessness.
Vulnerabilities: what weaknesses do you have today? Reused passwords? Nonexistent backups? A phone with no screen lock?
Risk: combine likelihood and impact with a simple scale (high, medium, low) and rank the risks from highest to lowest.
Treatment: pick the highest risk on the list and decide how to treat it this very week — mitigate it, transfer it, accept it, or avoid it.
Record: write down the decision and the date. That piece of paper is, in miniature, what organizations call a risk register.

By the end of the course you will repeat this exercise with more tools, but the structure of the reasoning —assets, threats, vulnerabilities, priority— is exactly the same one professionals use.

Key Takeaways

Cybersecurity protects systems, networks, and data against unauthorized access, alteration, and disruption — and it is a continuous process, not a product.
The CIA triad (confidentiality, integrity, availability) is the framework for reasoning about what you are protecting and why; its pillars sometimes pull against each other and must be balanced.
A vulnerability is the weakness, a threat is whoever could exploit it, and risk is the combination of both with the impact. Threats cannot be controlled; vulnerabilities can.
Perfect security does not exist: the goal is to manage risk — mitigate it, transfer it, accept it, or avoid it, but never ignore it.
Prioritize: identify your most valuable assets and concentrate your defenses there.

In the coming lessons we will explore networks, threats, and the concrete tools that bring these principles to life.