Cybersecurity: A Beginner's Field Guide

What Is Cybersecurity?

Cybersecurity is the practice of protecting computers, networks, programs, and data from unauthorised access, damage, disruption, or theft — and doing so while the systems remain usable by the people who are supposed to use them.

It is not a product you buy, and it is not a problem you solve once. It is an ongoing process of managing risk: deciding what you need to protect, understanding what could go wrong, and putting reasonable controls in place. Perfect security does not exist. The goal is to make attacks expensive, slow, noisy, and unlikely to succeed.

Why it matters

• Money. Ransomware and business email compromise cost organisations billions every year.
• Privacy. Breaches expose personal data — health records, addresses, financial details.
• Safety. Security failures in hospitals, power grids, water systems, and vehicles can kill people.
• Trust. A single incident can destroy customer confidence and a company's reputation.
• Legal duty. Laws such as GDPR, HIPAA, and PCI-DSS require organisations to protect data.

The three ideas beginners must separate

Who attacks, and why?

Defence in depth

No single control stops everything. Defence in depth means layering independent protections so that when one fails, another still stands between the attacker and the asset. A typical layering might be:

1. Physical — locks, badges, guards, cameras.
2. Perimeter — firewalls, VPN gateways, DDoS protection.
3. Network — segmentation, intrusion detection, encrypted traffic.
4. Endpoint — patching, antivirus/EDR, disk encryption.
5. Application — secure code, input validation, WAF.
6. Data — encryption at rest, access controls, backups.
7. Identity — MFA, least privilege, privileged access management.
8. People — awareness training, phishing simulations, clear policy.
9. Process — monitoring, incident response, recovery, lessons learned.

Core Security Principles

These principles appear again and again in every framework, standard, and job interview. Learn them properly and the rest of the field becomes much easier to navigate.

The CIA Triad

The CIA Triad is the foundation of information security. Every control you ever implement exists to protect one or more of these three properties.

AAA: Authentication, Authorisation, Accounting

• Authentication — proving who you are. ("Are you really Alice?")
• Authorisation — deciding what you are allowed to do. ("Alice may read the finance folder but not delete it.")
• Accounting / Auditing — recording what you did, so it can be reviewed later. ("Alice opened the file at 14:02.")

Other principles worth memorising

Control types

Networking Fundamentals

You cannot secure what you do not understand. Nearly every attack travels over a network, so a working knowledge of how data moves is essential.

The OSI model (and why anyone cares)

The OSI model is a seven-layer description of how network communication works. It is a teaching tool, but security professionals use it constantly to describe where an attack happens and where a defence belongs.

Handy mnemonic (7→1): All People Seem To Need Data Processing.

IP addresses and subnets

• IPv4 — 32-bit address, written as four octets, e.g. 192.168.1.10. About 4.3 billion possible addresses, which ran out.
• IPv6 — 128-bit address, e.g. 2001:0db8::1428:57ab. Effectively unlimited.
• Private ranges (not routable on the internet): 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. Devices here reach the internet via NAT.
• Loopback — 127.0.0.1 (localhost), the machine talking to itself.
• Subnet mask / CIDR — /24 means the first 24 bits identify the network, leaving 254 usable host addresses.

TCP vs UDP

Ports you should recognise

DNS, in one paragraph

DNS translates human names (example.com) into IP addresses. It is a hierarchical, cached, distributed database. Because it was designed without authentication, it is vulnerable to spoofing and cache poisoning. DNSSEC adds cryptographic signatures to DNS records to prove they are genuine, and DoH/DoT (DNS over HTTPS/TLS) encrypts the queries themselves.

NAT, proxies, and VPNs

• NAT (Network Address Translation) lets many private devices share one public IP. It hides internal structure but is not a security control by itself.
• Proxy — an intermediary that forwards requests. Can filter, log, and cache. A reverse proxy sits in front of servers; a forward proxy sits in front of clients.
• VPN — an encrypted tunnel between two points. Useful on untrusted Wi-Fi and for remote access. It hides traffic from the local network but not from the VPN provider or the destination.

Threats & Attacks

A tour of the techniques attackers actually use, grouped by what they are trying to achieve. You do not need to memorise every variant — you need to recognise the patterns.

The attack lifecycle

Most intrusions follow a recognisable sequence. Security teams map their defences to each stage in the hope of breaking the chain somewhere.

1. Reconnaissance — gathering information (public records, job ads, port scans, social media).
2. Initial access — phishing, exposed service, stolen credentials, supply chain.
3. Execution — running code on the target.
4. Persistence — ensuring access survives reboots and password changes.
5. Privilege escalation — moving from a normal user to administrator/root.
6. Defence evasion — disabling logs, obfuscating code, hiding in legitimate tools.
7. Credential access — dumping password hashes, keylogging, token theft.
8. Discovery — mapping the internal network and finding valuable systems.
9. Lateral movement — hopping from machine to machine.
10. Collection & exfiltration — gathering and stealing data.
11. Impact — encryption (ransomware), deletion, sabotage, extortion.

Attack categories

Malware Deep Dive

Malware is any software written to cause harm, gain unauthorised access, or steal information. Categories overlap heavily — real samples often combine several.

How malware gets in

• Phishing attachments and links — still the number-one entry point.
• Unpatched, internet-facing services — VPN appliances, web servers, RDP.
• Malicious or compromised websites — drive-by downloads and exploit kits.
• USB drives and removable media — especially in air-gapped environments.
• Supply chain compromise — a trusted update channel turned hostile.
• Pirated software and fake installers — a reliable delivery mechanism.
• Misconfigured cloud storage — not malware, but a direct path to the data.

Defences that actually work

• Patch promptly. Most successful attacks use known vulnerabilities with available fixes.
• Use EDR, not just antivirus. Signature-based AV misses new and fileless threats; EDR watches behaviour.
• Block macros by default in Office documents from the internet.
• Application allow-listing — only approved software runs.
• Backups, offline and tested. The 3-2-1 rule: 3 copies, 2 media types, 1 off-site/offline.
• Network segmentation to slow lateral movement.
• Disable unused services and ports.

Social Engineering

Social engineering attacks people rather than machines. It is often cheaper and more reliable than finding a software vulnerability — which is why it works so well.

Why it works: the psychological levers

Common techniques

• Pretexting — inventing a scenario to justify the request (an auditor, a new starter, a delivery driver).
• Baiting — leaving a tempting USB stick or download where it will be found.
• Tailgating / piggybacking — following an authorised person through a secure door.
• Quid pro quo — offering a service in exchange for information.
• Whaling — targeting senior executives, who often have the most access and the least time.
• Deepfake & voice cloning — using AI-generated audio or video to impersonate an executive on a call.
• Shoulder surfing — watching someone type a PIN or password.
• Dumpster diving — recovering documents from discarded waste.

Spotting a phishing email

• Unexpected message, especially about invoices, passwords, or deliveries.
• Urgency or threats — "immediate action required", "account suspended".
• Sender address looks almost right: support@micros0ft.com.
• Links whose visible text differs from the actual destination (hover to check).
• Generic greeting when the sender should know your name.
• Grammar, spelling, or formatting that feels slightly off.
• Requests for credentials, payment details, gift cards, or MFA codes.
• Attachments you did not expect — especially .zip, .iso, .html, macro-enabled Office files.
• Reply-to address different from the "from" address.
• Pressure to bypass a normal process "just this once".

Building a human firewall

• Regular, short, relevant awareness training — not a once-a-year video.
• Simulated phishing campaigns with constructive follow-up, never punishment.
• A blame-free reporting culture: reward people who report mistakes quickly.
• Simple, documented verification procedures for payments and access requests.
• Technical backstops so a single click is not catastrophic: MFA, least privilege, EDR.

Cryptography

Cryptography protects confidentiality, integrity, and authenticity. You do not need the mathematics to use it safely — but you do need to know which tool does what.

The three pillars

Symmetric encryption

One shared key encrypts and decrypts. It is fast and efficient — ideal for bulk data like files and disk volumes. The hard part is distributing the key securely.

• AES — the modern standard. AES-128 and AES-256 are both considered strong.
• ChaCha20 — fast in software, common on mobile.
• 3DES, DES, RC4, Blowfish — legacy or broken. Do not use for new work.
• Modes matter. Use AES-GCM or ChaCha20-Poly1305 (authenticated encryption). Avoid ECB, which leaks patterns.

Asymmetric encryption

A mathematically linked key pair: a public key anyone may have, and a private key only you hold. It solves key distribution but is much slower, so it is normally used to exchange a symmetric key rather than to encrypt bulk data.

• RSA — widely used; key sizes of 2048 bits minimum, 4096 preferred.
• Elliptic Curve (ECC) — equivalent strength with much smaller keys; common in TLS and mobile.
• Diffie-Hellman / ECDH — lets two parties agree on a shared secret over a public channel.

Hashing

A hash function takes any input and produces a fixed-size output. It is deterministic, fast, and effectively impossible to reverse. Hashes verify integrity and store passwords safely (with the right construction).

Salting and stretching

• Salt — random data added to each password before hashing, so identical passwords produce different hashes. Defeats rainbow tables.
• Pepper — a secret value added in addition to the salt and stored separately.
• Stretching / key derivation — deliberately repeating the hash many thousands of times so brute-force guessing becomes expensive.

TLS: how HTTPS actually works

TLS (Transport Layer Security) protects data in transit. A simplified handshake:

1. The client sends a ClientHello with supported cipher suites and a random value.
2. The server replies with a ServerHello, its certificate, and its own random value.
3. The client validates the certificate against trusted Certificate Authorities and checks the hostname.
4. Both sides use Diffie-Hellman to derive a shared session key.
5. Traffic is encrypted with fast symmetric encryption (AES-GCM or ChaCha20).
6. Forward secrecy (ephemeral keys) ensures past sessions stay safe even if the server's long-term key is later stolen.

Public Key Infrastructure (PKI)

• Certificate Authority (CA) — a trusted entity that signs certificates.
• Certificate — binds a public key to an identity (a domain name, an organisation).
• Root store — the set of root CAs your OS or browser trusts. Compromise here is catastrophic.
• Chain of trust — root → intermediate → leaf certificate.
• Revocation — CRL and OCSP mechanisms for invalidating certificates early.
• Let's Encrypt — a free, automated CA that made HTTPS universal.

Encryption at rest vs in transit

Cryptographic rules of thumb

• Never invent your own algorithm or protocol. Use vetted libraries and standard constructions.
• Never hard-code keys in source code or repositories. Use a secrets manager or KMS.
• Generate randomness with a CSPRNG, never rand() or timestamps.
• Use authenticated encryption (AES-GCM, ChaCha20-Poly1305) so tampering is detected.
• Plan for key rotation and for what happens when a key is compromised.
• Prepare for post-quantum — organisations are already migrating to quantum-resistant algorithms.

Authentication & Identity

Most breaches do not involve clever exploits — they involve valid credentials used by the wrong person. Identity is the modern security perimeter.

The three (plus two) authentication factors

Multi-factor authentication (MFA) requires two or more different categories. A password plus a PIN is not MFA — both are knowledge factors. A password plus an authenticator app is MFA.

MFA methods ranked

1. Hardware security keys (FIDO2/WebAuthn) — phishing-resistant. The best option available today.
2. Passkeys — FIDO2 credentials synced across your devices. Phishing-resistant and user-friendly.
3. Authenticator apps (TOTP) — time-based codes. Good, but a real-time phishing proxy can relay them.
4. Push notifications — convenient, but vulnerable to "MFA fatigue" — attackers spamming prompts until you approve one.
5. SMS codes — better than nothing, but vulnerable to SIM swapping, interception, and SS7 attacks.
6. Email codes — weakest; if your email is compromised, so is everything else.

Password guidance that reflects reality

• Length beats complexity. A long passphrase of four random words is stronger and easier to remember than P@ssw0rd1!.
• Never reuse passwords. One breach should not unlock ten accounts.
• Use a password manager. It generates and stores unique credentials; you only memorise one strong master passphrase.
• Do not force arbitrary rotation. Modern guidance (NIST SP 800-63B) says change passwords on evidence of compromise, not on a calendar.
• Check breach exposure. Services like Have I Been Pwned tell you if your address appears in known leaks.
• Block common passwords against a list of known-breached credentials.

Single Sign-On and federation

• SSO — one login grants access to many applications. Fewer passwords, centralised control, easier deprovisioning.
• SAML — XML-based federation protocol, common in enterprise apps.
• OAuth 2.0 — an authorisation framework: it lets an app access resources on your behalf without your password. It is not an authentication protocol on its own.
• OpenID Connect (OIDC) — an authentication layer built on OAuth 2.0. This is what "Sign in with Google" uses.
• Risks: a compromised identity provider becomes a skeleton key; token theft bypasses MFA; misconfigured redirect URIs leak tokens.

Identity lifecycle

1. Joiner — account created, role assigned, least privilege applied.
2. Mover — role changes; old access must be removed, not just added.
3. Leaver — accounts disabled promptly, tokens revoked, devices wiped, credentials rotated.

Access reviews and periodic recertification catch the permissions that accumulate over years. Orphaned accounts are a favourite target for attackers.

Access Control

Authentication answers "who are you?". Access control answers "what may you do?".

Access control models

Privileged Access Management (PAM)

Administrative accounts are the keys to the kingdom. PAM tools and practices reduce that risk:

• Just-in-time access — elevate only when needed, for a limited window.
• Credential vaulting — administrators never see the actual password.
• Session recording — every privileged session is logged and reviewable.
• Separate admin accounts — never browse the web or read email from a domain admin account.
• Tiered administration — tier 0 (domain controllers), tier 1 (servers), tier 2 (workstations). Credentials never move downward.

Linux permissions in 60 seconds

# -rwxr-x---  1 alice developers  4096 Jan 1 12:00 report.sh
#  │└┬┘└┬┘└┬┘     │       │
#  │ │  │  └── others: none
#  │ │  └───── group:  read + execute
#  │ └──────── owner:  read + write + execute
#  └────────── file type (- file, d directory, l symlink)

chmod 750 report.sh      # rwxr-x---  (owner 7, group 5, other 0)
chmod u+x script.sh      # add execute for the owner
chown alice:developers f # change owner and group

# Numeric values: r=4, w=2, x=1

Windows access control

• Security Identifier (SID) — the unique ID behind every user and group name.
• Discretionary Access Control List (DACL) — who is allowed or denied what.
• Access tokens — issued at logon and attached to every process the user runs.
• User Account Control (UAC) — prompts for elevation before administrative actions.
• Group Policy — centralised configuration and restriction of thousands of settings.
• Local Administrator Password Solution (LAPS) — randomises local admin passwords so one compromise does not spread.

Operating System Security

The operating system is where most of your data lives and most attacks land. Hardening it is one of the highest-value things you can do.

Universal hardening steps

• Keep the OS and all software patched — enable automatic updates where practical.
• Remove or disable software and services you do not use.
• Use a standard (non-administrator) account for daily work.
• Enable full-disk encryption (BitLocker, FileVault, LUKS).
• Enable the host firewall and block inbound traffic by default.
• Turn on automatic screen lock after a short idle period.
• Require a password/PIN/biometric to unlock.
• Disable autorun/autoplay for removable media.
• Enable audit logging and forward logs somewhere central.
• Use application allow-listing where feasible.
• Uninstall or disable legacy protocols (SMBv1, TLS 1.0/1.1, Telnet, LLMNR, NetBIOS).
• Back up regularly and test restores.

Windows specifics

• BitLocker — full-disk encryption; store recovery keys safely and separately.
• Windows Defender / Defender for Endpoint — built-in AV and EDR; keep real-time protection on.
• Credential Guard — isolates secrets so they cannot be dumped from memory.
• Attack Surface Reduction rules — block Office macros, script execution, and other common vectors.
• Disable SMBv1 — it is the protocol WannaCry exploited.
• Restrict RDP — never expose it to the internet; require VPN or a bastion host, plus MFA.
• Event logs to watch: 4624 (logon), 4625 (failed logon), 4720 (account created), 4672 (special privileges assigned), 7045 (service installed).

Linux specifics

• Disable root SSH login and password authentication — use key pairs.
• Keep sudo access minimal and log it.
• Use a host firewall — ufw, firewalld, or nftables.
• Install automatic security updates (unattended-upgrades on Debian/Ubuntu).
• Enable SELinux or AppArmor for mandatory access control.
• Harden SSH: change the port only as a noise reducer, not as a control; use fail2ban, disable empty passwords, restrict users.
• Logs to watch: /var/log/auth.log, journalctl, auditd.

# A minimal SSH hardening snippet (/etc/ssh/sshd_config)
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
PermitEmptyPasswords no
MaxAuthTries 3
X11Forwarding no
AllowUsers alice bob

Patching and vulnerability management

1. Inventory — you cannot patch what you do not know about.
2. Scan — use authenticated vulnerability scanners (Nessus, OpenVAS, Qualys) on a schedule.
3. Prioritise — not all vulnerabilities are equal. Weigh exploitability, exposure, and business impact. CVSS scores help, but context decides.
4. Patch — emergency patches within days, routine patches within weeks.
5. Verify — rescan to confirm the fix worked.
6. Compensate — where patching is impossible, add a compensating control (segmentation, virtual patching, WAF rule).

Web Application Security

Web apps are the most exposed part of most organisations. The OWASP Top 10 is the best-known catalogue of what goes wrong — and it is remarkably stable year to year.

OWASP Top 10 (2021)

Injection in practice

Vulnerable code concatenates user input directly into a query:

// DANGEROUS — never do this
query = "SELECT * FROM users WHERE name = '" + userName + "'";

// If userName is:  ' OR '1'='1' --
// The query becomes: SELECT * FROM users WHERE name = '' OR '1'='1' --'
// ...which returns every user.

The fix is parameterisation — the database treats input as data, never as code:

// SAFE — parameterised query
stmt = db.prepare("SELECT * FROM users WHERE name = ?");
stmt.execute([userName]);

Cross-site scripting (XSS)

• Stored XSS — the payload is saved on the server (a comment, a profile) and served to every visitor. Most dangerous.
• Reflected XSS — the payload comes back in the immediate response, usually via a crafted link.
• DOM-based XSS — client-side JavaScript writes untrusted data into the page.

Defence: context-aware output encoding, a strict Content Security Policy, avoiding innerHTML, and treating all input as untrusted.

Security headers worth setting

Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), camera=(), microphone=()

Cookie security

Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Strict; Path=/; Max-Age=3600

• Secure — only sent over HTTPS.
• HttpOnly — invisible to JavaScript, which blunts XSS session theft.
• SameSite=Strict|Lax — mitigates CSRF.
• Short lifetimes and server-side revocation reduce the damage of a stolen token.

Secure development practices

• Threat modelling early — ask "how would we attack this?" before writing code.
• Validate on the server, always. Client-side validation is for user experience only.
• Encode on output, based on context (HTML, attribute, JavaScript, URL, CSS).
• Never trust client input — headers, cookies, hidden fields, and file names included.
• Fail safely — generic error messages to users, detailed logs for developers.
• Manage secrets properly — vaults, environment injection, rotation; never in Git.
• Automate security testing — SAST in the IDE, DAST in staging, SCA for dependencies.

Network Security

Network security is about controlling what can talk to what, and knowing when something unexpected happens.

Firewalls

IDS vs IPS

• IDS (Intrusion Detection System) — watches traffic and raises alerts. Passive; it does not block.
• IPS (Intrusion Prevention System) — sits inline and can drop malicious traffic. Faster response, higher risk of false positives disrupting business.
• Detection methods: signature-based (known patterns), anomaly-based (deviations from baseline), and behaviour-based.
• Common tools: Snort, Suricata, Zeek, and cloud-native equivalents.

Network segmentation

Segmentation limits how far an attacker can move after initial access. Without it, one compromised laptop can reach everything.

• VLANs — logically separate networks on shared hardware.
• DMZ — a buffer zone for internet-facing services, isolated from the internal network.
• Microsegmentation — fine-grained, per-workload policies, common in modern data centres.
• Air gaps — physically separate networks for the most sensitive systems. Even these are not immune to USB-borne attacks.

Wireless security

Wireless hygiene:

• Use a long, random passphrase — 20+ characters.
• Change default router admin credentials and disable remote administration.
• Disable WPS (Wi-Fi Protected Setup) — its PIN is brute-forceable.
• Create a separate guest network for visitors and IoT devices.
• Keep router firmware updated.
• Use a VPN on untrusted networks, or better, use your phone's hotspot.

Virtual Private Networks

• Remote-access VPN — individual users connect to the corporate network.
• Site-to-site VPN — permanent tunnels between locations.
• IPSec — operates at layer 3; used for site-to-site and some client VPNs.
• WireGuard — modern, fast, small codebase; increasingly the default choice.
• Zero Trust Network Access (ZTNA) — replaces broad network access with per-application access, verified continuously.

Other network controls

• NAC (Network Access Control) — checks device compliance before allowing connection.
• 802.1X — port-based authentication for wired and wireless.
• DHCP snooping / Dynamic ARP Inspection — stop rogue DHCP and ARP spoofing.
• Honeypots — decoy systems that attract attackers and generate early warnings.
• Email authentication — SPF, DKIM, and DMARC make domain spoofing much harder.
• DDoS protection — content delivery networks, scrubbing centres, and rate limiting.

Endpoint & Data Security

Endpoints — laptops, desktops, phones, servers — are where users work and where attackers land. Data security is about protecting the information itself, wherever it goes.

The endpoint toolkit

Data classification

You cannot protect everything equally. Classify data so you know what deserves the strongest controls. A common scheme:

1. Public — marketing material, published docs.
2. Internal — most business information.
3. Confidential — customer data, contracts, financials.
4. Restricted / Secret — trade secrets, health records, credentials, M&A plans.

Data states

The 3-2-1 backup rule

• 3 copies of the data.
• 2 different storage media or technologies.
• 1 copy off-site or offline (immutable, air-gapped, or write-once).

Add a "0" and you get 3-2-1-0: zero errors on restore, verified by testing. Ransomware specifically hunts for backups, so at least one copy must be unreachable from the production network.

Secure disposal

• Shredding — physical destruction of paper and drives.
• Degaussing — magnetic erasure (does not work on SSDs).
• Cryptographic erasure — destroy the key, and the encrypted data becomes unreadable.
• Overwriting — multiple passes; less relevant now that full-disk encryption is common.
• Always obtain a certificate of destruction from the vendor.

Cloud & Container Security

The cloud is not inherently less secure — but the responsibility model changes, and the mistakes are different. Most cloud breaches come down to misconfiguration and excessive permissions.

The shared responsibility model

The simple rule: the provider secures the cloud; you secure what you put in it. Identity, data, configuration, and access are always your responsibility.

Top cloud risks

• Misconfigured storage — public buckets exposing sensitive data. Still the single most common cloud headline.
• Over-permissive IAM — wildcard permissions, unused access keys, roles that can escalate.
• Exposed management interfaces — databases, Kubernetes dashboards, and admin panels reachable from the internet.
• Leaked secrets — API keys committed to public repositories.
• Insecure APIs — the primary attack surface of modern applications.
• Insufficient logging — no audit trail to investigate an incident.
• Account takeover — no MFA on the cloud root account. Always enable MFA on root/global admin.

Cloud security best practices

• Enable MFA on all privileged accounts, especially the root/global admin.
• Apply least privilege to every IAM policy; review unused permissions regularly.
• Use roles and short-lived credentials instead of long-lived access keys.
• Encrypt data at rest and in transit; manage keys in a KMS/HSM.
• Block public access at the account level, then allow exceptions deliberately.
• Enable audit logging (CloudTrail, Activity Log, Cloud Audit Logs) and ship logs to a separate account.
• Use infrastructure as code with security scanning built into the pipeline.
• Enable cloud security posture management (CSPM) to catch drift and misconfiguration.
• Segment workloads with security groups, private subnets, and network policies.
• Define a data residency and retention policy that matches legal requirements.

Container and Kubernetes security

• Image hygiene — minimal base images, scan for vulnerabilities, sign images, and verify signatures.
• Do not run as root inside containers; use read-only filesystems where possible.
• Secrets management — never bake secrets into images or environment files committed to Git.
• Network policies — default-deny pod-to-pod communication.
• RBAC — restrict who can create pods, mount volumes, or exec into containers.
• Runtime security — detect unexpected process execution and file changes.
• Keep the orchestrator patched — Kubernetes CVEs are high impact.

DevSecOps: shifting left

Instead of testing security at the end, integrate it throughout the development pipeline:

1. Pre-commit — secret scanning, linting.
2. Build — software composition analysis (SCA) for vulnerable dependencies, SAST for code flaws.
3. Test — DAST against a running environment, container image scanning.
4. Deploy — infrastructure-as-code scanning, policy-as-code gates.
5. Run — runtime protection, continuous monitoring, CSPM.

Mobile & IoT Security

Phones and connected devices have become the largest and least-managed part of most networks. They deserve explicit attention.

Mobile threats

• Malicious apps — sideloaded APKs, fake apps in official stores, over-permissioned utilities.
• Smishing and vishing — SMS and voice phishing are far more effective on a phone screen.
• Juice jacking — malicious charging ports. Carry your own charger or a data blocker.
• Shoulder surfing and device theft — physical access defeats most software controls.
• Insecure data storage — apps writing sensitive data to unencrypted storage or backups.
• Excessive permissions — a flashlight app does not need your contacts.

Mobile hardening

• Keep the OS and apps updated.
• Use a 6+ digit passcode, not just biometrics (biometrics can be compelled in some jurisdictions).
• Enable device encryption (default on modern iOS and Android).
• Install apps only from official stores; review permissions before granting.
• Enable remote wipe and "find my device".
• Disable Bluetooth and NFC when not in use.
• Avoid jailbreaking/rooting — it disables core protections.
• Use a VPN on untrusted networks; disable auto-join for open Wi-Fi.
• Enrol in MDM if your organisation provides one.

IoT: the security debt of convenience

Cameras, thermostats, doorbells, printers, TVs, and industrial sensors are often shipped with weak defaults and rarely patched. The Mirai botnet built one of the largest DDoS attacks in history almost entirely from compromised cameras and routers.

OT and ICS: a different world

Operational technology (industrial control systems, SCADA, PLCs) prioritises availability and safety over confidentiality. These systems were often designed without security and cannot simply be patched. Controls focus on segmentation (Purdue model), unidirectional gateways, and strict change control. Never scan or test an OT network without explicit authorisation — you can physically damage equipment.

Security Operations & Incident Response

Prevention eventually fails. What separates a minor incident from a catastrophe is how quickly you detect it and how calmly you respond.

The SOC

A Security Operations Centre is the team and facility responsible for monitoring, detecting, and responding to security events around the clock. Typical tiers:

• Tier 1 — Triage. Monitors the alert queue, filters false positives, escalates real incidents.
• Tier 2 — Investigation. Deep-dives into escalated alerts, correlates data, contains threats.
• Tier 3 — Threat hunting & forensics. Proactively searches for hidden threats and handles complex intrusions.
• Engineers. Build and maintain the detection tooling and automation.
• Detection engineers. Write and tune the rules that generate alerts.

SIEM and log sources

A SIEM (Security Information and Event Management) platform collects logs from across the environment, correlates them, and generates alerts. Key sources:

• Authentication logs (successful and failed logins)
• Endpoint telemetry (process creation, file writes, registry changes)
• Network flow data and firewall logs
• DNS queries
• Web proxy and email gateway logs
• Cloud audit trails
• Application and database logs
• Physical access control systems

Detection engineering

• Signature-based detections — match known-bad patterns (a specific hash, filename, or command line).
• Anomaly-based detections — flag deviations from a baseline (a user logging in at 3 a.m. from a new country).
• TTP-based detections — focus on attacker behaviours rather than tools. These survive tool changes.
• MITRE ATT&CK — a knowledge base of adversary tactics and techniques. Use it to map coverage: "which techniques can we detect?"
• Purple teaming — red and blue teams work together to test and improve detections.

Incident response phases (NIST SP 800-61)

First responder priorities

1. Stay calm and follow the plan.
2. Do not power off a compromised machine if you can avoid it — memory contains valuable evidence. Isolate it from the network instead.
3. Preserve evidence — take memory captures, disk images, and logs before making changes. Maintain chain of custody.
4. Document everything with timestamps, who did what, and why.
5. Communicate through pre-agreed channels, not the possibly-compromised corporate email.
6. Involve the right people — legal, PR, executives, and external IR firms as needed.
7. Do not tip off the attacker. Public statements and obvious countermeasures can cause them to accelerate or destroy evidence.

Digital forensics basics

• Order of volatility — collect the most perishable evidence first: CPU registers, RAM, network connections, running processes, then disk, then archival backups.
• Write blockers — hardware that prevents modification of the source drive during imaging.
• Hashing — hash the image on acquisition and verify it later to prove integrity.
• Timeline analysis — reconstruct what happened and when, using file system timestamps and logs.
• Common tools: Volatility (memory), Autopsy/Sleuth Kit (disk), FTK Imager, KAPE, Wireshark (network).

Threat intelligence

• Tactical — indicators of compromise (IOCs): IP addresses, domains, file hashes. Useful but short-lived.
• Operational — attacker campaigns, tools, and infrastructure patterns.
• Strategic — long-term trends and threats to the organisation's sector, for leadership.
• Frameworks: MITRE ATT&CK, the Diamond Model, and the Cyber Kill Chain.

Risk, Frameworks & Law

Security is a business discipline as much as a technical one. These are the structures that let organisations make consistent, defensible decisions.

Risk management

Risk is the combination of the likelihood of a threat exploiting a vulnerability and the impact if it does. There are four ways to treat risk:

Quantitative vs qualitative risk

• Qualitative — high/medium/low ratings based on expert judgement. Fast, subjective, widely used.
• Quantitative — monetary values. Uses terms like SLE (single loss expectancy), ARO (annualised rate of occurrence), and ALE (annualised loss expectancy = SLE × ARO). Slower, but easier to justify spending.

Major frameworks and standards

Laws and regulations you may encounter

• GDPR (EU) — protects personal data of EU residents; requires breach notification within 72 hours; heavy fines.
• CCPA/CPRA (California) — consumer privacy rights and data sale restrictions.
• HIPAA (US) — protects health information.
• PCI-DSS — payment card data security.
• SOX (US) — financial reporting controls for public companies.
• CFAA (US) / Computer Misuse Act (UK) — criminalise unauthorised access. Relevant to what counts as "hacking".
• NIS2 (EU) — cybersecurity requirements for critical infrastructure and essential services.
• DORA (EU) — digital operational resilience for the financial sector.

Ethics and the law in practice

• Authorisation must be written, scoped, time-limited, and signed by someone with the authority to grant it.
• Rules of Engagement define what is in scope, what is off-limits, testing windows, and emergency contacts.
• Responsible disclosure — if you find a vulnerability, report it privately to the vendor and give them reasonable time to fix it before publishing.
• Bug bounty programmes provide legal safe harbour — but only within their stated scope and rules.
• Handle data responsibly — if you encounter personal data during a test, do not copy, share, or retain it.

Practical Checklists

Theory is useful; checklists get things done. These are starting points you can adapt to your own situation.

Personal security — do these today

• Install a password manager and start replacing reused passwords with generated ones.
• Turn on MFA everywhere it is offered, starting with email, banking, and cloud accounts.
• Update your devices, browsers, and apps — then enable automatic updates.
• Enable full-disk encryption on every laptop and phone.
• Set a screen lock with a short timeout.
• Review app permissions on your phone and revoke anything unnecessary.
• Check haveibeenpwned.com for your email addresses and change exposed passwords.
• Freeze your credit or set up fraud alerts if you have been breached.
• Set up a separate, backed-up recovery email for account recovery.
• Back up important files using the 3-2-1 rule.
• Use a privacy screen in public and be aware of who is behind you.
• Never plug in unknown USB drives or charge from unknown ports.

Small business — the first 20 things

• Enable MFA on all email, banking, and admin accounts.
• Ensure the person who set up your cloud account is not the only admin — and that the root account has MFA.
• Turn on automatic patching for OS and applications.
• Deploy endpoint protection with centralised monitoring.
• Enable email filtering and set up SPF, DKIM, and DMARC.
• Back up critical data daily, keep one copy offline, and test restores quarterly.
• Create a written incident response plan with names and phone numbers.
• Remove accounts for staff who have left, on the day they leave.
• Apply least privilege — most people do not need admin rights.
• Encrypt laptops and mobile devices.
• Secure the Wi-Fi: WPA3 or WPA2 with a long passphrase, guest network for visitors.
• Never expose RDP or databases directly to the internet.
• Train staff on phishing at least quarterly.
• Establish a payment verification process requiring a callback on a known number.
• Inventory your hardware and software — you cannot protect what you cannot see.
• Require a vendor security review before onboarding new SaaS tools.
• Get cyber insurance and understand exactly what it covers.
• Write down your data classification and retention rules.
• Review who has access to your cloud storage and make buckets private by default.
• Run a tabletop exercise: "Ransomware hits on a Friday afternoon. What do we do?"

Developer security checklist

• Never commit secrets to version control — use pre-commit hooks and secret scanning.
• Parameterise every database query.
• Encode output based on context; never trust client input.
• Hash passwords with bcrypt, scrypt, or Argon2 — never MD5 or SHA-1 alone.
• Validate and re-validate on the server.
• Keep dependencies updated and scan them automatically.
• Set security headers and use HTTPS everywhere with HSTS.
• Implement proper session management: secure cookies, timeouts, server-side revocation.
• Return generic error messages to users; log details for developers.
• Apply least privilege to database and service accounts.
• Threat model new features before building them.
• Add security tests to the CI pipeline and fail the build on critical findings.

Password manager setup in ten minutes

1. Choose a reputable, audited manager (Bitwarden, 1Password, KeePassXC, and others).
2. Create a long, unique master passphrase — four or five random words.
3. Enable MFA on the password manager account itself.
4. Export your browser's saved passwords and import them.
5. Change the most important passwords first: email, banking, cloud, work.
6. Let the manager generate 16+ character random passwords for everything else.
7. Store recovery codes somewhere safe and offline.
8. Set up a trusted emergency contact or recovery method.

Learning Path & Careers

Cybersecurity is broad, and there is no single correct entry point. The best route depends on what you already enjoy doing.

A suggested learning path for beginners

1. IT fundamentals. Hardware, operating systems, file systems, command line. You cannot secure what you do not understand.
2. Networking. TCP/IP, DNS, HTTP, subnets, routing, and packet analysis with Wireshark.
3. Operating systems in depth. Linux command line and Windows administration, including permissions, services, and logs.
4. Security fundamentals. CIA triad, authentication, access control, cryptography basics, risk.
5. Scripting. Python and Bash (or PowerShell). Automation is a force multiplier.
6. Hands-on practice. Build a home lab with virtual machines; use TryHackMe, Hack The Box, and OWASP Juice Shop.
7. Specialise. Blue team, red team, cloud, application security, GRC, or forensics.
8. Keep learning. Follow security news, read incident reports, join communities, attend local meetups.

Common roles

Certifications, roughly in order of difficulty

Practice platforms and labs

• TryHackMe — guided, beginner-friendly rooms with a strong learning path.
• Hack The Box — more challenging, less hand-holding; excellent for offensive skills.
• Blue Team Labs Online — defensive and forensic challenges.
• LetsDefend — a simulated SOC environment.
• PicoCTF — a great entry point to capture-the-flag competitions.
• OWASP Juice Shop / DVWA / WebGoat — deliberately vulnerable web apps for practice.
• Metasploitable — a deliberately vulnerable VM for safe practice.
• Your own home lab — VirtualBox or VMware with Kali, Windows, and a vulnerable target VM on an isolated network.

Tools worth learning

Staying current

• Vendor research blogs — Microsoft, Google Threat Intelligence, Cisco Talos, Mandiant, CrowdStrike, Sophos.
• Advisories — CISA KEV catalogue, NVD, vendor security bulletins.
• Communities — r/cybersecurity, r/netsec, OWASP chapters, local BSides and DEF CON groups.
• Podcasts and newsletters — a low-effort way to keep up with trends.
• Conferences — DEF CON, Black Hat, BSides (often free or cheap), RSA.

Extended Attack Reference

A deeper catalogue of attack techniques with real-world examples. Use this as a lookup reference when reading threat reports, studying for certifications, or designing defences. Attacks are grouped by domain so you can find them quickly.

20.1 Network Infrastructure Attacks

These target the protocols and devices that move data — routers, switches, DNS, and the trust relationships between them. Many are possible because older protocols were designed without authentication.

20.2 Advanced Web & API Attacks

Beyond the OWASP Top 10, these are the techniques that appear repeatedly in bug bounty reports and breach post-mortems.

20.3 Cryptographic Attacks

20.4 Wireless & RF Attacks

20.5 Physical & Hardware Attacks

20.6 Cloud & Container Attacks

20.7 Identity & Authentication Attacks

20.8 Supply Chain Attacks

20.9 AI & Machine Learning Attacks

20.10 OT, ICS & SCADA Attacks

20.11 Denial-of-Service Variants

20.12 Evasion & Anti-Forensics

Glossary

A quick-reference dictionary of the terms you will meet most often. Use the search box to filter.

Access Control

The process of determining and enforcing what a subject (user, process) may do with an object (file, service).

Adversary

An individual or group attempting to compromise a system. Also called a threat actor.

Air Gap

A physical separation between a system and untrusted networks, typically for highly sensitive environments.

ALE (Annualised Loss Expectancy)

Expected yearly financial loss from a risk: single loss expectancy × annual rate of occurrence.

APT (Advanced Persistent Threat)

A well-resourced, patient attacker — usually nation-state — that maintains long-term covert access.

ARP Spoofing

Sending forged ARP messages to associate the attacker's MAC address with another host's IP, enabling traffic interception on a local network.

Attack Surface

The total set of points where an attacker could try to enter or extract data. Smaller is better.

Authentication

Verifying a claimed identity. Distinct from authorisation.

Authorisation

Determining what an authenticated identity is permitted to do.

Backdoor

A hidden method of bypassing normal authentication, planted intentionally or left accidentally.

Bastion Host

A hardened server that provides controlled access from an untrusted network to an internal one.

Blue Team

The defensive side of security: monitoring, detection, and response.

Botnet

A network of compromised devices controlled remotely, used for DDoS, spam, or cryptocurrency mining.

Brute Force Attack

Systematically trying every possible credential or key until one works.

BYOD (Bring Your Own Device)

A policy allowing employees to use personal devices for work, which expands the attack surface.

CIA Triad

Confidentiality, Integrity, Availability — the three core goals of information security.

CISO

Chief Information Security Officer — the executive responsible for an organisation's security strategy and risk.

Clickjacking

Tricking a user into clicking something different from what they perceive, often via transparent overlays.

Cloud Security Posture Management (CSPM)

Tools that continuously check cloud configurations against security best practices.

Command and Control (C2)

The infrastructure an attacker uses to communicate with compromised systems.

Credential Stuffing

Automated login attempts using username/password pairs leaked from other breaches.

Cross-Site Request Forgery (CSRF)

Forcing a logged-in user's browser to submit an unwanted request to a site they trust.

Cross-Site Scripting (XSS)

Injecting malicious script into a page viewed by other users.

Cryptojacking

Secretly using a victim's computing resources to mine cryptocurrency.

CVE

Common Vulnerabilities and Exposures — a unique identifier for a publicly known vulnerability, e.g. CVE-2021-44228.

CVSS

Common Vulnerability Scoring System — a 0–10 severity score for vulnerabilities. Useful but not a substitute for business context.

Dark Web

Parts of the internet reachable only through anonymising networks such as Tor, often used for selling stolen data and malware.

Defence in Depth

Layering multiple independent security controls so a single failure is not fatal.

DMZ (Demilitarised Zone)

A network segment between the internet and the internal network that hosts internet-facing services.

DNS Sinkhole

Redirecting malicious domain lookups to a controlled server so malware cannot reach its C2 infrastructure.

DNSSEC

Cryptographic signatures added to DNS records to prove authenticity and integrity.

EDR (Endpoint Detection and Response)

Software that continuously records endpoint activity, detects suspicious behaviour, and supports investigation and response.

Encryption

Transforming readable data into an unreadable form using a key, reversible only with the correct key.

Exploit

Code or a technique that takes advantage of a vulnerability.

Exfiltration

Unauthorised transfer of data out of an organisation.

Firewall

A device or software that controls network traffic based on rules.

FIDO2 / WebAuthn

Standards for phishing-resistant authentication using hardware keys or passkeys.

Forensics

The collection, preservation, and analysis of digital evidence in a defensible manner.

GDPR

General Data Protection Regulation — EU law governing personal data protection and breach notification.

Hashing

A one-way function producing a fixed-length fingerprint of data, used for integrity checks and password storage.

Honeypot

A decoy system designed to attract attackers and reveal their techniques.

IDS / IPS

Intrusion Detection System (alerts) and Intrusion Prevention System (blocks).

IOC (Indicator of Compromise)

Evidence suggesting a breach: a malicious IP, domain, file hash, or registry key.

IAM (Identity and Access Management)

Systems and processes for managing digital identities and their permissions.

Incident Response

The organised approach to handling a security incident: preparation, detection, containment, eradication, recovery, and lessons learned.

Injection

Supplying untrusted input that is interpreted as code by the receiving system (SQL, command, LDAP).

Keylogger

Software or hardware that records keystrokes, capturing passwords and messages.

Lateral Movement

Moving from one compromised system to another within a network.

Least Privilege

Granting only the minimum access required to perform a task.

MFA (Multi-Factor Authentication)

Requiring two or more different authentication factors, such as a password plus a hardware key.

MITM (Man-in-the-Middle)

An attacker secretly intercepting and possibly altering communication between two parties.

MITRE ATT&CK

A curated knowledge base of adversary tactics, techniques, and procedures, used to structure detection and threat hunting.

Non-repudiation

Assurance that someone cannot deny having performed an action, typically achieved with digital signatures.

Patch

A software update that fixes a bug or vulnerability.

Payload

The part of an attack that performs the malicious action after exploitation.

Penetration Test

An authorised, simulated attack against systems to identify weaknesses, performed under a defined scope and rules of engagement.

Phishing

Fraudulent communication designed to trick recipients into revealing information or installing malware.

PII (Personally Identifiable Information)

Data that can identify an individual, alone or combined with other data.

Pivoting

Using a compromised host as a jumping-off point to reach other systems.

PKI (Public Key Infrastructure)

The system of certificate authorities, certificates, and policies that enables trusted public-key cryptography.

Privilege Escalation

Gaining higher permissions than intended, either vertically (more rights) or horizontally (other users' rights).

Ransomware

Malware that encrypts data and demands payment for the decryption key, often with data theft for double extortion.

Red Team

Security professionals who emulate adversaries to test an organisation's defences.

Rootkit

Malware that conceals its presence, often by modifying the operating system itself.

Salt

Random data added to a password before hashing so identical passwords produce different hashes.

SBOM (Software Bill of Materials)

A machine-readable inventory of the components in a piece of software, used for supply chain risk management.

SIEM

Security Information and Event Management — a platform that aggregates logs and correlates events to detect incidents.

Smishing

Phishing conducted via SMS text messages.

Social Engineering

Manipulating people into breaking normal security procedures or revealing information.

Spear Phishing

Highly targeted phishing tailored to a specific individual using research.

SPF / DKIM / DMARC

Email authentication mechanisms that help prevent domain spoofing and improve deliverability.

SQL Injection

Injecting SQL statements through unsanitised input to read or modify a database.

SSRF (Server-Side Request Forgery)

Tricking a server into making requests to internal resources on the attacker's behalf.

Supply Chain Attack

Compromising a trusted third party — a vendor, library, or update mechanism — to reach their customers.

Symmetric Encryption

Encryption using a single shared key for both encryption and decryption. Fast, but key distribution is the challenge.

Threat Hunting

Proactively searching for threats that have evaded existing detection, using hypotheses and data analysis.

Threat Modelling

A structured process for identifying what can go wrong in a system and how to address it. Often uses STRIDE or attack trees.

TLS (Transport Layer Security)

The protocol that encrypts and authenticates data in transit, underlying HTTPS.

Trojan

Malware disguised as legitimate software.

TTP (Tactics, Techniques, Procedures)

The behavioural patterns of an attacker — more durable indicators than specific tools.

Vishing

Phishing conducted over a voice call.

Vulnerability

A weakness that could be exploited to compromise a system.

WAF (Web Application Firewall)

A filter placed in front of a web application to block common attacks such as SQL injection and XSS.

Whaling

Phishing specifically targeting senior executives.

Worm

Self-replicating malware that spreads across networks without user interaction.

Zero Trust

A security model that assumes no implicit trust based on network location, verifying every request explicitly.

Zero-Day

A vulnerability with no available patch, or an exploit for such a vulnerability.

No terms matched your search.