Cyber Security Introduction

Every time you pay with UPI, check your exam result online or book a Tatkal ticket, you trust that a computer system will keep your data private, correct and available. Cyber security is the work of making sure that trust is deserved.

In this lesson you will learn what cyber security means, the three goals every defender protects (the CIA triad), and the core words of the field: asset, threat, vulnerability and risk. You will also score risks with a few lines of Python.

What is cyber security?

Cyber security is the practice of protecting computers, networks, applications and data from being accessed, changed, stolen or disrupted by people who should not be able to do so. It covers technology (firewalls, encryption, secure code), processes (backups, patching, incident plans) and people (training, good habits).

Security is not only about stopping "hackers". A careless employee who emails the wrong spreadsheet, a power cut that wipes a server without a backup, or a laptop stolen from a car are all security problems too.

The CIA triad

Almost every security decision protects one or more of three goals, known as the CIA triad:

Some incidents hit more than one goal. Ransomware usually encrypts files (availability) and also steals a copy first to threaten the victim (confidentiality). Here is a small program that labels incidents with the goal they damage. Run it, then add an incident of your own.

# Which part of the CIA triad does each incident damage?
incidents = {
    "Exam marks changed before results day": "Integrity",
    "Customer KYC files emailed to a stranger": "Confidentiality",
    "Railway booking site down during Tatkal hour": "Availability",
    "Shop invoices edited to hide sales": "Integrity",
}

for incident, goal in incidents.items():
    print(f"{goal:<16} <- {incident}")

Integrity        <- Exam marks changed before results day
Confidentiality  <- Customer KYC files emailed to a stranger
Availability     <- Railway booking site down during Tatkal hour
Integrity        <- Shop invoices edited to hide sales

Two more ideas often sit next to the triad. Authenticity means you can trust who sent something (a real bank SMS, not a fake one). Non-repudiation means a person cannot later deny an action, which digital signatures make possible.

Assets, threats and vulnerabilities

Security people use a few words very precisely. Learn them now, because every later lesson uses them.

• An asset is anything of value: customer data, a website, a payment server, even a company's reputation.
• A threat is anything that could harm an asset: a criminal, a flood, a disgruntled employee, a bug.
• A threat actor is the person or group behind a threat, such as a cyber criminal gang, an insider, a hacktivist or a state-backed group.
• A vulnerability is a weakness that a threat can use: an unpatched server, a weak password, a form that trusts user input.
• An exploit is a method or piece of code that takes advantage of a vulnerability.
• A control (or safeguard) is anything that reduces risk: a patch, a firewall rule, a backup, a training session.

A threat without a vulnerability does little harm. A thief cannot use a door that is locked. Your job as a defender is mostly to find and close vulnerabilities before a threat actor finds them.

Risk: likelihood times impact

Risk is the chance that a threat uses a vulnerability, multiplied by how bad the result would be. A simple way to score it is:

risk score = likelihood (1 to 5) x impact (1 to 5)

A score of 20 is far more urgent than a score of 4. Organisations keep a risk register, a list of risks with their scores and owners, and they fix the biggest ones first. Priya runs a small online saree shop in Jaipur. Here is her first risk register as a Python list:

risks = [
    {"asset": "Shop website", "threat": "SQL injection", "likelihood": 4, "impact": 5},
    {"asset": "Office Wi-Fi", "threat": "Weak shared password", "likelihood": 3, "impact": 3},
    {"asset": "Billing laptop", "threat": "Theft from car", "likelihood": 2, "impact": 4},
    {"asset": "Email accounts", "threat": "Phishing", "likelihood": 5, "impact": 4},
]

def level(score):
    if score >= 15:
        return "HIGH"
    if score >= 8:
        return "MEDIUM"
    return "LOW"

for r in risks:
    r["score"] = r["likelihood"] * r["impact"]

for r in sorted(risks, key=lambda r: r["score"], reverse=True):
    print(f'{r["score"]:>2} {level(r["score"]):<6} {r["asset"]}: {r["threat"]}')

20 HIGH   Shop website: SQL injection
20 HIGH   Email accounts: Phishing
 9 MEDIUM Office Wi-Fi: Weak shared password
 8 MEDIUM Billing laptop: Theft from car

Once a risk is scored, there are four ways to treat it:

• Reduce it with a control (fix the code, turn on multi-factor login).
• Avoid it by stopping the risky activity (stop storing card numbers at all).
• Transfer it to someone else (cyber insurance, a payment gateway that handles cards).
• Accept it, in writing, when the cost of fixing is higher than the possible loss.

Defence in depth

No single control is perfect, so defenders stack several layers. This is called defence in depth. If phishing tricks Kabir into typing his password, multi-factor authentication still blocks the attacker. If that fails, logging and alerts let the team notice the strange login. If all of that fails, backups let the business recover.

layers = ["Security training", "Email filter", "Multi-factor login", "Login alerts", "Offline backups"]
stopped_by = "Multi-factor login"

for layer in layers:
    if layer == stopped_by:
        print(f"{layer}: attack stopped here")
        break
    print(f"{layer}: attack got past")

Security training: attack got past
Email filter: attack got past
Multi-factor login: attack stopped here

Common mistakes

• Thinking security is only a technical problem. Many breaches start with a phone call, a fake email or a lost laptop. People and processes matter as much as tools.
• Treating every risk as equally urgent. Score risks and fix the biggest first, or you will spend your time on small issues while a serious hole stays open.
• Testing systems you do not own "just to see". Scanning or probing someone else's system without written permission is illegal in India and most countries, even if you mean no harm.

Key points

• Cyber security protects systems and data from unauthorised access, change, theft and disruption.
• The CIA triad is confidentiality, integrity and availability.
• A threat uses a vulnerability to harm an asset; controls reduce that chance.
• Risk is roughly likelihood times impact, and risks are reduced, avoided, transferred or accepted.
• Defence in depth stacks several controls so one failure does not mean a breach.
• Ethical hacking is legal only with written permission, so practise in your own lab.

risks = [
    ("Student database", "Stolen admin password", 4, 5),
    ("Fee payment page", "Fake payment page link", 3, 4),
    ("Class videos", "Leaked on Telegram", 4, 2),
    ("Office PC", "Ransomware", 2, 5),
]

for asset, threat, likelihood, impact in sorted(risks, key=lambda r: r[2] * r[3], reverse=True):
    score = likelihood * impact
    flag = "URGENT" if score >= 15 else ""
    print(score, asset, "-", threat, flag)