Chapter 21 — Front Matter
Purpose and Overview
Every connected system faces risk. Data moves across networks. Programs run on shared machines. Millions of people use devices that hold private information, financial records, personal messages, medical histories, and professional secrets. Keeping those systems, networks, and data safe is the work of cybersecurity.
This chapter introduces cybersecurity as a discipline — not as a collection of alarming news stories, not as hacker mythology, and not as a catalog of tricks. Cybersecurity is the disciplined practice of protecting systems, networks, devices, and data from unauthorized access, damage, disruption, and misuse. It involves understanding how attacks work, why systems are vulnerable, and how defenders design systems that resist harm.
By the end of this chapter, students should be able to name major categories of cybersecurity threats, explain the difference between vulnerabilities and attacks, describe common defensive strategies, understand how authentication and authorization protect systems, follow the conceptual logic of encryption, and reason carefully about security tradeoffs in real systems. This chapter will not teach students to attack systems. It will teach students to think like defenders.
Opening Question
A hospital's patient records system goes offline. Surgeries are delayed. Staff cannot access medical histories. Nurses write notes on paper. A ransom note appears on every screen demanding cryptocurrency payment. How did this happen? What could have prevented it? What should the hospital do now? By the end of this chapter, you will have the vocabulary and reasoning to answer those questions.
10Sections
10Objectives
40+Key Terms
3Worked Examples
Learning Objectives
- 1Describe what cybersecurity protects and explain the CIA triad (confidentiality, integrity, availability).
- 2Distinguish between threats, vulnerabilities, and risk, and explain the concept of attack surface.
- 3Name and describe the major categories of malware and explain how each spreads and causes harm.
- 4Explain social engineering and identify common techniques including phishing, spear phishing, and pretexting.
- 5Explain authentication, the three authentication factors, and why multifactor authentication improves security.
- 6Explain authorization and the principle of least privilege.
- 7Describe symmetric and asymmetric encryption at a conceptual level and explain the difference between data in transit and data at rest.
- 8Explain why data backups matter and describe the 3-2-1 backup rule.
- 9Explain patch management and describe the risks of using end-of-life software.
- 10Describe defense in depth as a layered security strategy and apply basic threat-modeling thinking to a scenario.
Sections at a Glance
- 21.1What Cybersecurity ProtectsSystems, networks, devices, data; the CIA triad; confidentiality, integrity, availability
- 21.2Threats, Vulnerabilities, and RiskDefining threats, vulnerabilities, threat actors; risk as likelihood × impact; attack surface
- 21.3MalwareViruses, worms, Trojans, ransomware, spyware, rootkits, botnets; entry pathways; defenses
- 21.4Phishing and Social EngineeringPhishing, spear phishing, whaling, smishing, vishing; pretexting, baiting, tailgating; defenses
- 21.5AuthenticationThree authentication factors; MFA; passwords; password attacks; password hashing
- 21.6Authorization and PermissionsDAC, RBAC, MAC; file system permissions; least privilege; access control
- 21.7Encryption at an Introductory LevelPlaintext, ciphertext; symmetric vs. asymmetric encryption; data in transit vs. at rest
- 21.8Backups and RecoveryWhy backups matter; 3-2-1 rule; RPO and RTO; disaster recovery
- 21.9Updates and Patch ManagementSecurity patches; exposure window; end-of-life software; auto-updates
- 21.10Defense in DepthPhysical, network, endpoint, application, identity, data, human, monitoring; threat modeling
Sections 21.1 – 21.2
What Cybersecurity Protects and Why Systems Are Vulnerable
The CIA Triad · Threats · Vulnerabilities · Risk · Attack Surface
Section 21.1
What Cybersecurity Protects
Cybersecurity protects four things: systems, networks, devices, and data. A system is any organized arrangement of hardware, software, and processes designed to perform a function. A hospital's patient record system, a bank's transaction processing system, and a city's traffic management system are all examples. Each one holds information and performs actions that matter to real people — disrupting or corrupting them causes real harm. A network is the infrastructure connecting systems and devices. A device is any physical computing hardware. Data is the information stored, processed, and transmitted across all of these.
Security professionals organize their thinking around three core properties, often called the CIA triad. These three properties define what it means for a system to be secure, and every significant cybersecurity incident can be described as a failure of one or more of them.
Confidentiality
Information is accessible only to those who are authorized to see it. Unauthorized parties cannot read, copy, or intercept sensitive data.
Integrity
Information is accurate and complete. It has not been altered, corrupted, or destroyed by unauthorized parties.
Availability
Systems, networks, and data are accessible when authorized users need them. Services remain operational and responsive.
The CIA triad is not a formula — it is a checklist and a way of framing tradeoffs. A system that is perfectly available but has no confidentiality controls is not secure. A system with perfect confidentiality but no integrity checking can be quietly corrupted. Real security requires balancing all three properties, and the right balance depends on the system's purpose and the value of the data it holds.
Example — Ransomware and the CIA Triad
A ransomware attack encrypts a hospital's patient files and demands payment for the decryption key. This is an availability failure — authorized staff cannot access the data they need. If attackers also copy the data before encrypting it, it is also a confidentiality failure. If the attack corrupts records, it is also an integrity failure. Most serious attacks violate more than one property at once.
- A power outage takes down a city's emergency dispatch system for four hours. Which CIA property has been violated? Explain your reasoning.
- An attacker intercepts private messages traveling across a network and reads them. Which property has been violated?
- An attacker modifies financial records to change account balances by small amounts, hoping no one will notice. Which property does this primarily attack?
- Can a system be fully available but not secure? Explain using an example.
Section 21.2
Threats, Vulnerabilities, and Risk
Three concepts form the foundation of security thinking. A threat is any potential event, person, or circumstance that could cause harm to a system. A vulnerability is a weakness in a system that a threat could exploit. Risk is the combination of the likelihood that a threat will exploit a vulnerability and the potential impact of that exploitation. Having a vulnerability does not guarantee that harm will occur — it means a system has a weakness that could be exploited if a threat is present and capable.
| Concept | Definition | Example |
|---|
| Threat | Any potential source of harm to a system | Ransomware groups targeting hospitals; disgruntled employees; natural disasters |
| Vulnerability | A weakness that could be exploited | Unpatched software, default passwords, misconfigured permissions, untrained staff |
| Threat actor | Any entity that might exploit a vulnerability | Outside attackers, malicious insiders, nation-state groups, automated bots |
| Risk | Likelihood × Impact of exploitation | High-likelihood + high-impact = high priority for immediate action |
Attack Surface
Attack surface describes the total set of points in a system where an attacker could attempt to gain access — every open port, every running service, every user account, every piece of software with known vulnerabilities. Reducing the attack surface is a fundamental security strategy. Every service turned off, every unnecessary account deleted, and every unneeded piece of software removed makes the attack surface smaller and the system harder to compromise.
- A company uses software that hasn't been updated in two years. A security researcher has publicly documented an exploit for a vulnerability in that software version. Classify the threat, the vulnerability, and explain why this represents high risk.
- A small business has fifty computers. Ten are running software that hasn't been updated. Five share a login with the password "admin." Three have antivirus software disabled. How do each of these contribute to the attack surface?
- Explain why the concept of attack surface means that adding more features to software always comes with a security cost.
Section 21.4
Phishing and Social Engineering
Many attacks do not exploit software vulnerabilities at all — they exploit human psychology. This category is called social engineering: manipulating people into doing something that helps the attacker. Social engineering is often the first step in sophisticated attacks on well-defended systems, precisely because humans are harder to patch than software.
Forms of Phishing
| Type | Description |
|---|
| Phishing | Mass emails impersonating a trusted entity (bank, tech company, government) to steal credentials or install malware |
| Spear phishing | Targeted phishing crafted for a specific individual or organization using researched personal details |
| Whaling | Spear phishing aimed at high-value targets: executives, directors, senior officials |
| Smishing | Phishing conducted through text messages (SMS) |
| Vishing | Phishing conducted through phone calls |
Other Social Engineering Techniques
| Technique | How It Works |
|---|
| Pretexting | Attacker creates a fabricated scenario to justify requesting information — e.g., calls pretending to be IT support |
| Baiting | Leaves a malware-infected USB drive where a curious person will find and plug it in |
| Tailgating | Physically follows an authorized person through a secure door by appearing to belong there |
| Quid pro quo | Offers something (technical help, information) in exchange for credentials or access |
Why Social Engineering Works
Social engineering exploits real human tendencies: the desire to be helpful, the instinct to obey apparent authority, the response to urgency and fear, the tendency to trust people who seem familiar, and reluctance to embarrass someone who appears to belong. These are not character flaws — they are normal human responses that attackers have learned to exploit systematically. Urgency is almost always a manipulation tactic; slow down and verify before acting.
Recognizing a Phishing Email
Sample Phishing Email — Read Carefully
Subject: URGENT — Your PayPal account has been limited
Dear Valued Customer,
We have detected unusual activity on your account. To restore full access, you must verify your identity within 24 hours or your account will be permanently suspended.
[Verify My Account Now]
PayPal Customer Security Team
Red Flags in That Email
The sender domain is "paypa1.com" (number one, not letter L). Legitimate organizations do not threaten permanent suspension after 24 hours. Generic greeting "Valued Customer" rather than your name. Urgency designed to prevent careful thought. The link destination may differ from what it appears to be. When in doubt, navigate directly to the official site rather than clicking any link in the email.
- An employee receives a call from someone claiming to be from the IT department, saying there is a virus on the employee's computer and they need the employee's login credentials to fix it remotely. What social engineering technique is this? What should the employee do?
- Why is spear phishing more dangerous than generic phishing, even though it reaches fewer people?
- A physical security guard lets a person in a delivery uniform through a secure door without checking their badge because the person's arms are full of boxes. What social engineering technique is being used? What procedure should the guard follow instead?
- List three characteristics that should make a person suspicious that a message may be a phishing attempt.
Sections 21.5 – 21.7
Authentication, Authorization, and Encryption
Three Auth Factors · MFA · Passwords · Least Privilege · Symmetric vs. Asymmetric Encryption
Section 21.5
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be. Before a system grants access, it must verify identity. Authentication relies on one or more of three factors.
| Factor | What It Means | Examples |
|---|
| Something you know | A secret the user has memorized | Password, PIN, security question answer |
| Something you have | A physical object in the user's possession | Hardware token, smartphone, smart card, authenticator app |
| Something you are | A biological characteristic of the user | Fingerprint, face scan, voice pattern, retina scan |
Single-factor authentication uses only one factor — typically a password. It is vulnerable because if that one factor is compromised (stolen, guessed, leaked in a data breach), the attacker has everything they need. Multifactor authentication (MFA) requires two or more independent factors. Even if a password is stolen, an attacker still cannot authenticate without also having the second factor — a code sent to the user's phone, or a fingerprint. MFA is one of the single most effective defenses against unauthorized account access.
Passwords
| Password Attack | How It Works |
|---|
| Brute force | Systematically trying every possible combination of characters until one works |
| Dictionary attack | Trying common words, phrases, and known passwords from lists |
| Credential stuffing | Using username/password pairs leaked from one service to try access at other services |
| Phishing | Tricking the user into entering their password on a fake login page |
| Shoulder surfing | Physically watching someone type their password |
Worked Example 21.5.1
Evaluating Password Strength
- Password
password — Extremely weak. The most common password in leaked databases. First entry on every dictionary attack list.
- Password
P@ssw0rd — Still weak. Common character substitutions (@ for a, 0 for o) are well-known to attackers and appear in wordlists.
- Password
Fluffy2015! — Moderately weak. Combines a real word (probably a pet's name) with a predictable year. Attackers research personal details for targeted attacks.
- Password
correct-horse-battery-staple — Much stronger. Long passphrase of random words. Length provides significant resistance to brute force. Easier to remember than complex short passwords.
- Password
Xk9#mP2$vL7@nQ — Very strong. Random, long, mixes all character types. Nearly impossible to guess; only practical attack is obtaining it through phishing or a breach of the stored hash.
Key principle: length matters more than complexity alone. A 20-character passphrase of random words is significantly stronger than an 8-character "complex" password. Use a password manager to generate and store strong, unique passwords for every account.
Password Hashing
Well-designed systems never store passwords in plain text. Instead, they store a hash — the result of running the password through a one-way mathematical function. When a user logs in, the system hashes the entered password and compares the result to the stored hash. If an attacker steals the database, they get hashes, not passwords. Reversing a strong hash is computationally very difficult. Weak passwords can still be cracked using precomputed tables called rainbow tables, which is why strong, unique passwords remain important even when hashing is in use.
- A banking website requires a password plus a 6-digit code sent by text message each time a user logs in. Which authentication factors are being used? Is this single-factor or multifactor authentication?
- A user has the same password for their email, their bank account, and an online shopping site. The shopping site is breached and all passwords are leaked. What attack could now threaten the email and bank accounts? Name the attack type.
- Explain why storing a password as a hash is better than storing it in plain text, but why hashing alone is not sufficient protection for weak passwords.
- Why would biometric authentication (fingerprint or face scan) be considered a "something you are" factor? What is one limitation of biometric authentication compared to a password?
Section 21.6
Authorization and Permissions
Authentication asks "Who are you?" Authorization asks "What are you allowed to do?" A user can be fully authenticated — the system is certain of their identity — and still be restricted from certain resources, files, or actions. Authorization enforces those restrictions.
The principle of least privilege states that users and programs should have only the permissions they need for their legitimate function — and no more. An employee who processes expense reports does not need access to payroll records. A web application should not run with administrator rights. A mobile app does not need access to the user's contacts if it is a simple calculator. Least privilege limits the damage that results from an account being compromised or a program being subverted. If an attacker gains access to a limited account, they can only do what that account is authorized to do.
Access Control Models
| Model | How It Works | Where It's Used |
|---|
| DAC (Discretionary) | Resource owners decide who has access and in what way | Personal computer file systems; most everyday software |
| RBAC (Role-Based) | Permissions are assigned to roles (doctor, nurse, accountant); users are assigned to roles | Hospitals, corporations, enterprise software |
| MAC (Mandatory) | A central authority assigns classification levels; access is determined by clearance | Military and government systems; high-security environments |
Worked Example 21.6.1
Applying Least Privilege — Medical Clinic Database
- ScenarioA small medical clinic's database holds patient contact information, medical records, billing data, insurance details, and employee payroll records. Assign appropriate permissions to each role.
- ReceptionistRead access to patient names and contact information only. No access to medical records, billing details, or payroll. They need names to book appointments — nothing more.
- NurseRead/write access to patient names, contact information, and medical history. No access to billing details or payroll. They need to record clinical notes, not process payments.
- Billing SpecialistAccess to patient names, billing information, and insurance details. No access to medical history or payroll. They need financial records, not clinical records.
- IT AdminSystem-level access for maintenance; ideally, access controls can be designed so IT can maintain the database structure without reading the actual patient data inside it.
Principle: each role accesses only what its legitimate function requires. If a receptionist's account is compromised, the attacker gains contact information — not complete medical histories. Least privilege contains the damage of any single breach.
- A software developer at a tech company is given administrator rights on every server in the company so they can do their work more easily. What principle does this violate? What risks does it create?
- A mobile app for tracking daily step counts requests access to the user's contacts, microphone, camera, and location. What principle does this appear to violate? What should a security-aware user do?
- Explain in your own words why the principle of least privilege reduces the damage caused by a security breach, even if it does not prevent the breach itself.
Section 21.7
Encryption at an Introductory Level
Encryption transforms readable data (plaintext) into an unreadable form (ciphertext) using a mathematical algorithm and a key. Only someone with the correct key can reverse the process (decryption) and recover the original plaintext. Encryption is one of the most important tools in information security. It protects data in transit across networks and data at rest on storage devices. Even if an attacker intercepts or steals encrypted data, the data is useless without the key.
Symmetric Encryption
In symmetric encryption, the same key is used to encrypt and decrypt. Both parties must have the key, and they must keep it secret. Symmetric encryption is fast and suitable for large amounts of data. The challenge is key distribution: how do two parties securely share a key before they have a secure channel to communicate through?
Plaintext
→
Encrypt
with Key A
→
Ciphertext
→
Decrypt
with Key A
→
Plaintext
Symmetric: same key on both ends
Asymmetric Encryption
Asymmetric encryption (also called public-key cryptography) uses two mathematically related keys: a public key and a private key. Data encrypted with the public key can only be decrypted with the private key. The public key is shared freely. The private key is kept secret. This solves the key distribution problem — anyone can encrypt a message to you using your public key, but only you can decrypt it with your private key.
Plaintext
→
Encrypt with
Receiver's Public Key
→
Ciphertext
→
Decrypt with
Receiver's Private Key
→
Plaintext
Asymmetric: public key encrypts; only the matching private key decrypts
How HTTPS Uses Both
HTTPS uses asymmetric encryption to establish a secure channel and exchange a symmetric session key. Then it switches to symmetric encryption for the actual data transfer. This combines the key-distribution strength of asymmetric encryption with the speed of symmetric encryption — a practical solution to a real engineering tradeoff.
Data in Transit vs. Data at Rest
| State | Description | Protection Method |
|---|
| Data in transit | Data moving across a network — from browser to server, between email servers, across a VPN | HTTPS, encrypted email, VPN; prevents eavesdroppers from reading intercepted packets |
| Data at rest | Data stored on a disk, database, or cloud server | Disk encryption, database encryption; protects data if storage is stolen or accessed without authorization |
What Encryption Does Not Do
Encryption protects the content of data — not who is communicating, when, or the fact that communication is occurring. It does not protect data from someone who already has the key, and it does not prevent access if an authorized user's credentials are compromised. Encryption is an essential tool, not a complete solution.
- In symmetric encryption, what is the fundamental challenge when two strangers want to communicate securely for the first time?
- An attacker intercepts an HTTPS transmission and captures the ciphertext. They also look up the receiver's public key, which is publicly available. Can they decrypt the message? Explain why or why not.
- A laptop is stolen from a traveler's bag. The laptop's hard drive is fully encrypted. What does the encryption protect? What does it not protect?
- Explain in your own words why HTTPS uses both asymmetric and symmetric encryption rather than just one type.
Sections 21.8 – 21.10
Backups, Patch Management, and Defense in Depth
3-2-1 Backup Rule · End-of-Life Software · Layered Defense · Threat Modeling
Section 21.8
Backups and Recovery
Data backups are copies of data stored separately from the original, so that if the original is lost, corrupted, or held for ransom, the data can be recovered. Backups are one of the most reliable defenses against data loss — including ransomware. An organization with current, tested, offline backups can recover from a ransomware attack without paying the ransom.
The 3-2-1 Backup Rule
- Keep 3 copies of the data (the original plus two backups)
- On 2 different types of storage media (for example, an internal drive and an external drive)
- With 1 copy stored offsite or in the cloud, disconnected from the primary network
The offsite or offline requirement is critical: backups stored on the same network as the original can be encrypted by the same ransomware attack. Offline and offsite copies cannot.
| Backup Principle | Why It Matters |
|---|
| Regular backups | The gap between backups is data that could be lost. A 24-hour backup cycle means up to 24 hours of work is at risk. |
| Tested backups | A backup is only as useful as its ability to actually restore data. Untested backups have failed organizations at the worst possible moment. |
| Offline or offsite copies | Backups on the same network can be compromised alongside the primary data. Physical separation prevents this. |
- A school backs up its student records every Sunday night to an external drive that stays connected to the school's server. Ransomware attacks the school on a Friday afternoon and encrypts all files, including the backup drive. What went wrong? How should the backup strategy be improved?
- Apply the 3-2-1 rule to design a backup strategy for a small business that processes customer orders. Where would each of the three copies be stored?
- Why is it not sufficient to simply make a backup — why must backups be tested?
Section 21.9
Updates and Patch Management
Software contains bugs. Some bugs cause crashes or unexpected behavior. Others create security vulnerabilities — weaknesses that attackers can exploit to gain unauthorized access, escalate privileges, or execute malicious code. When a vulnerability is discovered, the software developer typically releases a patch — an update that fixes it. The process of systematically applying patches is called patch management.
Between the time a vulnerability is discovered and the time a patch is applied, systems are exposed. If the vulnerability becomes public knowledge before patches are applied, attackers can target unpatched systems at scale. This window is called the exposure window. Some of the most damaging attacks in history exploited known vulnerabilities for which patches already existed — organizations that had applied the patch were protected; those that had not were compromised.
WannaCry — A Lesson in Patch Management
The WannaCry ransomware attack of 2017 exploited a Windows vulnerability for which Microsoft had released a patch approximately two months earlier. Organizations that had applied the patch were unaffected. Those that had not — including many hospitals in the United Kingdom's National Health Service — had their systems encrypted and were unable to access patient records for days. The cause was not an unknown, undefended vulnerability. It was a known, patchable vulnerability that had not been patched.
| Update Type | Purpose |
|---|
| Security patch | Fixes a specific vulnerability that could be exploited by attackers |
| Bug fix | Corrects non-security errors that cause crashes or incorrect behavior |
| Feature update | Adds new functionality |
| Performance update | Improves speed or efficiency |
End-of-Life Software
Software eventually reaches end of life (EOL) — the point at which the developer stops releasing updates, including security patches. New vulnerabilities discovered in EOL software will never be fixed. Systems running EOL software become increasingly vulnerable over time as new exploits are discovered and published. Replacing or upgrading EOL software is an important and often overlooked security responsibility.
- A hospital's IT staff delays applying security patches for three months because they are worried updates might cause problems with their specialized software. A known vulnerability is exploited during that window. What could they have done differently? What does this tradeoff reveal about real-world security decisions?
- Explain the concept of an "exposure window." Why does the exposure window create urgency around applying security patches quickly?
- A company continues to use an operating system that reached end of life two years ago. The software still works fine. What security risk does this create, and why does that risk grow over time?
Section 21.10
Defense in Depth
No single security measure is sufficient. A determined attacker who encounters one defense will look for another way in. The strategy of using multiple independent, overlapping layers of security — so that bypassing one does not grant full access — is called defense in depth. The term comes from military strategy: if one defensive line fails, others remain to limit the advance. In computing, the goal is similar: even if one control is bypassed, others should slow or stop the attack and limit the damage.
01
Physical Security
Locked rooms, access badges, security cameras, biometric entry. If an attacker can physically reach a device, digital defenses become irrelevant.
02
Network Security
Firewalls, intrusion detection systems, network segmentation. Controls and filters traffic entering and moving through the network.
03
Endpoint Security
Antivirus/antimalware, host-based firewalls, disk encryption, automatic screen locks on individual devices.
04
Application Security
Input validation, secure coding practices, security testing before deployment, keeping applications updated.
05
Identity & Access Management
Strong authentication, multifactor authentication, least privilege, regular auditing of who has access to what.
06
Data Security
Encryption of sensitive data at rest and in transit, data classification, controlled export, secure disposal.
07
Human Layer
Training users to recognize phishing, report suspicious activity, follow security policies, and use strong authentication. Often the weakest link.
08
Monitoring & Response
Logging events, monitoring for anomalies, incident response procedures, practicing recovery. Detects and limits damage when prevention fails.
Threat Modeling
Thinking like a defender means systematically asking adversarial questions about every system and process. This practice is called threat modeling. A basic threat model asks:
Threat Modeling Questions
- What could go wrong with this system?
- Who might want to cause this harm, and why?
- How would they try to do it? What vulnerabilities could they exploit?
- What defenses exist? Which are strongest and which are weakest?
- If those defenses fail, what then? What is the fallback?
- How would we detect that something has gone wrong?
- How would we recover from an incident?
Worked Example 21.10.1
Classifying a Security Incident — Full Analysis
- ScenarioA university student receives an urgent email appearing to come from IT, warning that their account will be disabled in 24 hours unless they verify their identity. They click the link, enter their credentials on a realistic-looking fake page, and receive a reassuring confirmation. Two days later their account is used to send thousands of spam emails.
- Attack typePhishing — a fraudulent email impersonating a trusted entity directed to a fake login page to steal credentials.
- What attacker gainedThe student's username and password — their authentication credentials. The account was then enrolled in a spamming botnet.
- CIA triadConfidentiality violated (credentials stolen). Availability threatened (account may be suspended for spam). Integrity violated (account used to send content the student never created).
- PreventionsMultifactor authentication would have blocked the attacker even with the password. Training to recognize urgency as a phishing tactic. Navigating to the official login page directly rather than clicking email links. Email filtering to quarantine phishing attempts before they reach the inbox.
No single prevention is complete. MFA would have stopped account access. Training might have prevented the click. Email filtering might have blocked the delivery. This is defense in depth working across multiple layers.
- An employee's laptop is stolen from a coffee shop. The laptop has no screen lock, no disk encryption, and the user was logged into their company email. Which defense-in-depth layers were missing or failed? What data and systems are now at risk?
- A company invests heavily in a state-of-the-art firewall but does nothing to train employees about phishing. An attacker bypasses the firewall by sending a spear phishing email that tricks an executive into entering their credentials. Which defense layer was bypassed? What does this suggest about relying on only one strong control?
- Apply basic threat modeling to a public library's computer terminals available for general use. Identify two realistic threats, describe the vulnerability each could exploit, and suggest one defense for each threat.
- A small nonprofit has a very limited security budget and can implement only two measures first. Choose from: antivirus software, multifactor authentication for all accounts, employee phishing training, regular data backups, firewall, or password manager policy. Which two would you choose and why?
Chapter 21 — Back Matter
Chapter Summary
- 21.1Cybersecurity protects systems, networks, devices, and data. The CIA triad — confidentiality, integrity, and availability — defines what security means and how failures are classified.
- 21.2Threats are potential sources of harm; vulnerabilities are weaknesses that could be exploited; risk combines likelihood and impact. Reducing the attack surface reduces risk.
- 21.3Malware — including viruses, worms, Trojans, ransomware, spyware, rootkits, and botnets — causes harm through various entry pathways. Defenses include updates, antimalware, careful downloads, and backups.
- 21.4Social engineering attacks human psychology rather than software. Phishing and its variants (spear phishing, whaling, smishing, vishing) impersonate trusted entities. Urgency is a manipulation tactic; verification is the defense.
- 21.5Authentication uses something you know, something you have, or something you are. Multifactor authentication requires two or more factors. Strong, unique passwords and password managers significantly reduce risk.
- 21.6Authorization controls what authenticated users can do. The principle of least privilege limits permissions to what each role actually needs, containing the damage from any breach.
- 21.7Encryption converts plaintext to ciphertext using a key. Symmetric encryption uses one key; asymmetric encryption uses a public/private key pair. Encryption protects both data in transit and data at rest.
- 21.8Backups provide recovery when data is lost or held hostage. The 3-2-1 rule — three copies, two media types, one offsite — ensures backups survive the same event that destroys the original.
- 21.9Patch management — systematically applying software updates — closes known vulnerabilities. The exposure window between disclosure and patching is a high-risk period. End-of-life software receives no patches and grows permanently more vulnerable.
- 21.10Defense in depth uses multiple overlapping layers — physical, network, endpoint, application, identity, data, human, and monitoring — so no single failure causes total compromise. Threat modeling asks adversarial questions to expose weaknesses before attackers do.
Key Terms Review
CIA triad
The three foundational properties of security: confidentiality, integrity, and availability.
attack surface
The total set of points in a system where an attacker could attempt to gain access or cause harm.
threat
Any potential event, person, or circumstance that could cause harm to a system.
vulnerability
A weakness in a system that could be exploited by a threat.
risk
The combination of the likelihood that a threat will exploit a vulnerability and the impact of the resulting harm.
malware
Software designed to cause harm; includes viruses, worms, Trojans, ransomware, spyware, rootkits, and botnets.
ransomware
Malware that encrypts the victim's files and demands payment for the decryption key.
worm
Malware that self-replicates and spreads across networks without requiring human action.
botnet
A network of compromised computers controlled remotely by an attacker, often without the owners' knowledge.
social engineering
Attacks that manipulate human psychology rather than exploiting software vulnerabilities.
phishing
A social engineering attack that impersonates a trusted entity to steal credentials or install malware.
spear phishing
Targeted phishing crafted for a specific individual or organization using researched personal details.
authentication
The process of verifying that a person or system is who or what it claims to be.
multifactor auth
Authentication requiring two or more independent factors: something you know, have, or are.
authorization
The process of determining what an authenticated user or system is permitted to do.
least privilege
The principle that users and programs should have only the permissions they need — no more.
encryption
Converting plaintext into ciphertext using an algorithm and a key so that only authorized parties can read it.
symmetric encryption
Encryption using the same key to encrypt and decrypt. Fast but requires secure key sharing.
asymmetric encryption
Encryption using a public key to encrypt and a private key to decrypt. Solves the key distribution problem.
data in transit
Data actively moving across a network. Protected by HTTPS, VPNs, encrypted messaging.
data at rest
Data stored on a disk, database, or cloud server. Protected by disk and database encryption.
patch
A software update that fixes a bug or security vulnerability.
patch management
The systematic process of applying software updates to keep systems secure.
end of life (EOL)
The point at which a vendor stops releasing updates for software, including security patches.
defense in depth
A security strategy using multiple independent, overlapping layers of protection.
threat modeling
Systematically asking adversarial questions about a system to identify vulnerabilities before attackers do.
firewall
A system that monitors and filters network traffic based on security rules.
3-2-1 backup rule
Keep 3 copies of data, on 2 different media types, with 1 copy offsite or offline.
Concept Check
Answer these questions before moving to the practice problems. Review the relevant section if you cannot answer any of them.
- Name the three properties of the CIA triad and give a one-sentence explanation of each.
- What is the difference between a threat and a vulnerability? Can a system have a vulnerability without facing a threat?
- Name five types of malware and describe in one sentence what each one does.
- What is social engineering? Give one example that involves a computer and one that does not.
- What are the three authentication factors? Give a real-world example of each.
- Why does multifactor authentication significantly improve security even when a password is compromised?
- What is the difference between symmetric and asymmetric encryption? What problem does asymmetric encryption solve that symmetric encryption cannot?
- What does the 3-2-1 backup rule recommend? Why does the "1 offsite" copy matter specifically for ransomware defense?
- What is an exposure window, and why does it create urgency around patch management?
- Name four layers in a defense-in-depth strategy and explain what each one protects against.
Practice Questions
- A company discovers that an employee has been forwarding internal financial documents to a competitor for six months. The employee had legitimate access to those documents as part of their job. Identify whether this represents a threat, a vulnerability, or both, and explain your reasoning.
- A web application stores user passwords as MD5 hashes in its database. A security researcher reports the application is vulnerable. Explain why storing hashed passwords is better than storing plaintext passwords, and why MD5 is considered insufficient for this purpose today.
- A small business uses the password "admin" for its router, its backup server, and its cloud storage service. Identify at least three security principles this practice violates.
- An attacker sends 2,000 emails to employees of a company claiming to be from the CFO and requesting urgent wire transfers. Most employees recognize it as suspicious and report it. Three do not. Name the attack type. What properties of the email made it effective for those three employees?
- Compare a virus and a worm. What do they have in common? How do they spread differently? Which is more dangerous in a network environment?
- A hospital considers disabling multifactor authentication because nurses report it slows them down during emergencies. Describe the security tradeoff involved. Suggest a compromise approach that addresses both concerns.
- Explain why a password manager improves security even though storing all passwords in one place might seem riskier at first.
- A company has excellent antivirus software on all computers but rarely applies software updates. Is this company well protected? Explain the specific vulnerability this creates.
- Explain the difference between data in transit and data at rest. Give one concrete example of each and one appropriate protection for each.
- A school district keeps student records on servers running software that hasn't been updated in three years. A ransomware attack encrypts all student records. Trace how this situation developed: identify the vulnerability, the threat, the attack pathway, and which CIA properties were violated. What defenses, if implemented earlier, might have prevented or significantly limited this incident?
- Design a basic defense-in-depth strategy for a small e-commerce website that stores customer names, addresses, and payment card numbers. Name at least one specific control at each of the following layers: physical, network, application, identity and access management, and data security.
- A software company releases a flashlight app that requests access to the user's contacts, microphone, camera, location, and photo library. What security and privacy principle does this violate? What risks does this create for users? What should a security-aware user do?
- You are responsible for cybersecurity at a small nonprofit with a very limited budget. You can implement only two security measures immediately. Choose from: antivirus software, multifactor authentication for all accounts, phishing awareness training, regular offsite backups, network firewall, or password manager policy. Justify your two choices with reference to risk reduction and cost-effectiveness.
Debugging and Error Analysis
Each statement contains a misconception, error, or incomplete reasoning. Identify the problem and explain what is correct.
Error 1
"Our database was breached, but it's fine — we hash all our passwords. Even if attackers have the hashes, they can't log in without the plain-text passwords."
What is wrong with this reasoning? What risk remains even with hashed passwords?
Error 2
"We use HTTPS on our website, so our users' data is completely secure."
Identify at least two things HTTPS does not protect against. What does it specifically protect?
Error 3
"We haven't been attacked in five years. Our current security must be sufficient."
Why does an absence of known attacks not confirm that security is sufficient?
Error 4
"We back up our data every week to an external drive that stays plugged into our server. We're fully protected from ransomware."
What critical backup principle is being violated here? How could ransomware defeat this backup strategy?
Error 5
"Using a complicated 8-character password like 'X7k!2mP@' is always more secure than a long simple phrase like 'correct-horse-battery-staple'."
Evaluate this claim. What does research on password strength actually show about length versus complexity?
Error 6
"Our most important security measure is our antivirus software. As long as we run regular antivirus scans, we're protected from most attacks."
What attacks does antivirus software not protect against? What does this error say about single-layer security thinking?
Chapter 21 Checkpoint
Complete independently — assesses all key skills and concepts from Chapter 21
Section 1 — Vocabulary and Concepts
- Define the CIA triad and give a one-sentence example of each property being violated.
- Explain the difference between a threat and a vulnerability using a specific, concrete example.
- Name three types of malware that do not require human action to spread or that are particularly difficult to detect. Explain each briefly.
Section 2 — Authentication and Authorization
- Identify the authentication factor type for each of the following: fingerprint scan, hardware security key, PIN number, face recognition.
- A user has their password stolen in a phishing attack. The attacker attempts to log in to the user's bank account. Explain two independent defenses that might still stop the attacker from gaining access.
- Explain the principle of least privilege and give a specific example of a permission assignment that violates it.
Section 3 — Encryption
- In asymmetric encryption, which key does the sender use to encrypt? Which key does the receiver use to decrypt? Why can an attacker who has the public key still not read the ciphertext?
- A journalist stores sensitive interview recordings on a laptop. The laptop is seized. The drive is fully encrypted. What does this encryption protect? What does it not protect?
Section 4 — Practical Security
- Apply the 3-2-1 backup rule to design a backup strategy for a law firm that handles confidential client documents. Specify where each copy would be stored and why.
- A company's main accounting software reached end of life eight months ago. New vulnerabilities in that software version are being disclosed regularly. Describe the specific risk this creates. What should the company prioritize?
Section 5 — Scenario and Application
- A university student receives a text message claiming to be from their bank, saying their account has been locked and they must call an urgent number to restore it. Identify the social engineering technique used. List three specific steps the student should take instead of calling the number.
- An attacker bypasses a company's excellent network firewall by sending a spear phishing email to the CEO. The CEO clicks a link and enters credentials on a fake company login page. List the defense-in-depth layers that were not implemented or failed. Suggest one control at each missing layer that could have limited the damage.
Real-World Applications
- In 2021, a ransomware attack on a major fuel pipeline in the United States caused the company to shut down operations for nearly a week, leading to fuel shortages across the eastern United States. Using the CIA triad, classify which properties were violated. What does this incident suggest about the relationship between cybersecurity and physical infrastructure?
- Many websites now offer users the option to view a report of active sessions — showing every device currently logged into their account, with location and browser information. What security purpose does this feature serve? What should a user do if they see a session they don't recognize?
- Some organizations prohibit employees from using personal USB drives on work computers. Why might this policy exist? What specific threat does it reduce? What practical inconveniences does it create, and how might those be addressed without sacrificing security?
- When a major data breach exposes millions of username and password pairs, security professionals advise affected users to change their password on other websites too, not just the breached site. Explain why a breach on one website should affect users' security decisions on other, completely unrelated websites. Name the specific attack type this enables.
- A security researcher discovers a serious vulnerability in widely used network software and responsibly discloses it to the vendor before making it public. The vendor releases a patch two weeks later. The researcher then publishes a detailed description. Why is responsible disclosure — telling the vendor before the public — an important part of the cybersecurity ecosystem?
Mixed Review
These questions connect Chapter 21 to earlier chapters in the textbook.
- (Chapter 19) A packet traveling from a user's laptop to a web server passes through several routers. If the connection is not encrypted, what can an attacker who controls one of those routers potentially see or do?
- (Chapter 20) Why is HTTPS preferable to HTTP for websites that handle login forms, even if those websites seem unimportant to the attacker?
- (Chapter 16) Operating systems manage user accounts and file permissions. How does the OS's permission system support the principle of least privilege at the level of individual files and directories?
- (Chapter 14) A company stores customer data in a CSV file on a shared network drive with no access controls. Using the CIA triad, describe what properties could be violated and how.
- (Chapter 4) Encryption relies on mathematical operations applied to data represented in binary. Why is it impossible to "see" what encrypted data contains just by reading the bits, even if you know the encryption algorithm — but not the key?
- (Chapter 18) A database administrator can set permissions on individual tables in a relational database. How does this capability support least-privilege access control in an organization with many employees who have different job functions?
MGU Library Connection
- Cybersecurity Foundations (MGU CS Series) — advanced treatment of all topics introduced in this chapter
- Appendix I of this textbook: Cybersecurity and Privacy Reference
- Chapter 22: Privacy, Identity, and Digital Safety — continues the human and social dimensions of security
- Chapter 19: Networks and the Internet — foundational for understanding how data travels and can be intercepted
- Chapter 20: The World Wide Web — context for HTTPS, browsers, and web-based attacks
- MGU Dictionary entries: encryption, authentication, malware, phishing, CIA triad, defense in depth
Looking Ahead
Chapter 22: Privacy, Identity, and Digital Safety
Chapter 21 introduced the technical side of cybersecurity: threats, malware, authentication, encryption, backups, updates, and defense in depth. These are the tools and strategies used to protect systems and data. Chapter 22 turns to the human side. Technical security measures protect systems — but privacy concerns what happens to the information those systems collect about people, and what the consequences are for individuals when that information is misused, exposed, or exploited. In Chapter 22, students will learn what personal data and metadata are, how digital systems track behavior and location, how online identity and digital reputation work, how to evaluate privacy settings and make informed consent decisions, and how to recognize scams, manipulation, and online threats to personal safety. Chapter 22 connects the technical systems introduced throughout Part V to the real human lives those systems affect.
Phishing and Social Engineering
Many attacks do not exploit software vulnerabilities at all — they exploit human psychology. This category is called social engineering: manipulating people into doing something that helps the attacker. Social engineering is often the first step in sophisticated attacks on well-defended systems, precisely because humans are harder to patch than software.
Forms of Phishing
Other Social Engineering Techniques
Social engineering exploits real human tendencies: the desire to be helpful, the instinct to obey apparent authority, the response to urgency and fear, the tendency to trust people who seem familiar, and reluctance to embarrass someone who appears to belong. These are not character flaws — they are normal human responses that attackers have learned to exploit systematically. Urgency is almost always a manipulation tactic; slow down and verify before acting.
Recognizing a Phishing Email
Dear Valued Customer,
We have detected unusual activity on your account. To restore full access, you must verify your identity within 24 hours or your account will be permanently suspended.
[Verify My Account Now]
PayPal Customer Security Team
The sender domain is "paypa1.com" (number one, not letter L). Legitimate organizations do not threaten permanent suspension after 24 hours. Generic greeting "Valued Customer" rather than your name. Urgency designed to prevent careful thought. The link destination may differ from what it appears to be. When in doubt, navigate directly to the official site rather than clicking any link in the email.