Cybersecurity and Digital Safety

1. What Is Cybersecurity?

Cybersecurity is the practice of protecting computers, networks, applications, and data from unauthorized access, disruption, damage, or theft.

It includes technical measures, organizational policies, and the everyday decisions people make while using digital services.

The CIA triad

2. Threats, Vulnerabilities, and Risk

• Threat: Something that could cause harm to a system or its information.
• Vulnerability: A weakness that could be exploited.
• Exploit: A method or action that takes advantage of a vulnerability.
• Risk: The possibility and potential impact of a threat causing harm.
• Mitigation: A measure that reduces the likelihood or impact of harm.

3. Common Cyber Threats

Malware

Malware is software designed to cause harm, misuse resources, or gain unauthorized access.

Phishing

Phishing is a form of social engineering in which someone pretends to be a trusted person or organization to trick people into revealing information or taking unsafe actions.

Other common threats

• Credential theft: Stealing usernames, passwords, or authentication tokens.
• Denial of service: Overwhelming a service so legitimate users cannot access it.
• Man-in-the-middle attack: Intercepting or interfering with communication between parties.
• Insider threat: Risk caused by someone with legitimate access, intentionally or accidentally.

4. Social Engineering and Phishing Detection

Social engineering targets human decisions rather than relying only on technical weaknesses. Attackers may create urgency, impersonate authority, or promise rewards to influence a person.

Warning signs

• Unexpected requests for passwords, verification codes, or payment.
• Messages that pressure you to act immediately.
• Unusual sender addresses or website domains.
• Unexpected attachments or links.
• Requests to bypass normal procedures or keep a transaction secret.

What should you do with a suspicious message?

1. Do not click links or open unexpected attachments.
2. Check the sender and the request carefully.
3. Open the official website or app independently.
4. Report the message through the service or your organization's approved process.
5. If you already shared sensitive information, change affected credentials and contact the relevant service promptly.

5. Passwords and Authentication

Authentication verifies that a user or system is who or what it claims to be.

Good password practices

• Use long, unique passwords or passphrases for different accounts.
• Use a reputable password manager to create and store passwords.
• Never share verification codes or passwords with someone who asks unexpectedly.
• Enable multifactor authentication wherever available.
• Change credentials promptly if you suspect an account has been compromised.

Multifactor authentication (MFA)

MFA combines two or more different kinds of evidence:

• Something you know: A password or PIN.
• Something you have: A security key or authentication device.
• Something you are: A biometric characteristic, such as a fingerprint.

6. Encryption and Hashing

Encryption

Encryption transforms readable data into a form that cannot normally be understood without the appropriate key. It helps protect information during storage and transmission.

• Symmetric encryption: Uses the same secret key for encryption and decryption.
• Asymmetric encryption: Uses a related public and private key pair.

Hashing

A cryptographic hash function maps input data to a fixed-size output called a hash. It is designed to make it computationally difficult to find an input that produces a chosen hash or to find two different inputs with the same hash.

7. Network Security

Network security helps protect communication, connected devices, and services from unauthorized activity.

• Firewall: Filters network traffic according to configured rules.
• HTTPS: Uses TLS to protect communication between a browser and a website, helping provide confidentiality and integrity.
• VPN: Creates a protected connection over another network; it does not automatically make every online activity anonymous or safe.
• Secure Wi-Fi: Uses appropriate wireless security settings and a strong network password.
• Network monitoring: Helps detect unusual traffic and potential security incidents.

8. Updates, Backups, and Device Safety

Security updates

Software updates can fix vulnerabilities, improve reliability, and add security features. Install updates from official, trusted sources.

Backups

Backups help recover data after accidental deletion, device failure, or some cyber incidents. Keep important backups protected from unauthorized access and, where possible, from changes made by compromised devices.

Practical safety checklist

• Keep your operating system, browser, and applications updated.
• Install software from official or trusted sources.
• Review app permissions before granting access to sensitive data.
• Lock devices when not in use.
• Back up important files and periodically check that recovery works.
• Avoid sensitive transactions on untrusted devices or networks.
• Remove applications and browser extensions you no longer need.

9. Privacy and Digital Footprints

A digital footprint is the trail of information associated with your online activity. It can include posts, comments, uploaded files, account activity, and information collected by websites or apps.

Protecting your privacy

• Think carefully before sharing personal information publicly.
• Review privacy and audience settings on social platforms.
• Limit unnecessary app permissions and data collection.
• Be cautious when sharing live location, travel plans, or identifying documents.
• Remember that deleting a post may not remove copies already saved or shared by others.

10. Responsible and Ethical Cybersecurity

Cybersecurity knowledge should be used to protect systems and information. Testing a system without permission can violate privacy, policies, or laws.

• Test only systems you own or are explicitly authorized to assess.
• Use legal training labs and intentionally vulnerable practice environments for learning.
• Do not access, change, or share another person's data without permission.
• Report vulnerabilities responsibly to the appropriate owner or security team.
• Follow the rules and scope of any security testing program.

Core security principles

• Least privilege: Give users and programs only the permissions they need.
• Defense in depth: Use multiple layers of protection instead of relying on one measure.
• Secure by default: Prefer settings that minimize unnecessary exposure.
• Incident response: Prepare to identify, contain, investigate, and recover from security incidents.

11. Knowledge Check

Try answering each question before revealing the answer.

Key Takeaways

• Cybersecurity protects systems, networks, applications, and information.
• The CIA triad describes confidentiality, integrity, and availability.
• Malware, phishing, and credential theft are common threats.
• Unique passwords and multifactor authentication help protect accounts.
• Encryption and hashing serve different purposes.
• Updates, backups, and careful permission management reduce risk.
• Online privacy and responsible behaviour are important parts of digital safety.
• Security testing must be authorized and conducted responsibly.