Cybersecurity Basics

Cybersecurity Basics: Threats, Firewalls, and Best Practices

Cybersecurity protects systems, networks, and data from unauthorized access, damage, and disruption. It combines technical controls (firewalls, encryption, patch management), administrative controls (policies, user training), and physical controls. Understanding the threat landscape and the layers of defense is the starting point for any security role.

The threat landscape: what attackers actually do

Most successful attacks exploit one of three things: unpatched software vulnerabilities, weak or stolen credentials, or social engineering of users. Phishing is the dominant delivery method for credential theft and malware installation because it targets humans rather than technical defenses. Ransomware, which encrypts victim files and demands payment for the decryption key, has become the most disruptive threat to organizations of every size because even well-patched environments can fall victim if a user clicks a malicious email attachment.

Other common threats include man-in-the-middle attacks (intercepting communications between two parties), SQL injection (inserting database commands into input fields to extract or corrupt data), cross-site scripting (injecting malicious scripts into web pages viewed by other users), and denial-of-service attacks (flooding a service with traffic to make it unavailable). Understanding how each attack works at a conceptual level is necessary both for building defenses and for the major IT security certifications.

Firewalls and network security controls

A firewall enforces rules about which network traffic is allowed to pass between networks or network segments. Traditional packet-filtering firewalls inspect source address, destination address, and port number. Stateful firewalls track the state of active connections and can distinguish legitimate return traffic from unsolicited inbound packets. Next-generation firewalls (NGFWs) add application awareness, intrusion prevention, and SSL inspection to inspect encrypted traffic.

Network security is structured in layers. A DMZ (demilitarized zone) places public-facing servers in a segment separated from the internal network by firewalls on both sides. Intrusion Detection Systems (IDS) monitor traffic and alert on suspicious patterns; Intrusion Prevention Systems (IPS) can block suspicious traffic automatically. VPNs (Virtual Private Networks) encrypt traffic between endpoints, securing communication over untrusted networks such as the public internet.

Encryption: protecting data in transit and at rest

Encryption converts plaintext into ciphertext that only the intended recipient can read. Symmetric encryption uses the same key for both encryption and decryption; AES (Advanced Encryption Standard) is the current standard symmetric cipher and is used in TLS, disk encryption, and VPNs. Asymmetric encryption uses a mathematically linked public/private key pair: data encrypted with a public key can only be decrypted with the corresponding private key. RSA and elliptic-curve cryptography (ECC) are the dominant asymmetric algorithms.

TLS (Transport Layer Security) secures web traffic, email submission, and many other protocols by combining asymmetric key exchange with symmetric encryption. When a browser connects to an HTTPS site, TLS negotiates the cipher suite, exchanges keys, and establishes an encrypted channel before any application data flows. Certificates issued by Certificate Authorities (CAs) provide the trust anchor that lets the browser verify it is talking to the right server.

Access control, identity, and the principle of least privilege

Access control determines who can reach which resources. Authentication verifies identity (passwords, multi-factor authentication, certificates, biometrics). Authorization determines what an authenticated identity is permitted to do. Role-based access control (RBAC) assigns permissions to roles rather than individuals, making management more consistent at scale. Multi-factor authentication (MFA) requires at least two factors from different categories (something you know, something you have, something you are) and dramatically reduces the risk of credential theft attacks.

The principle of least privilege states that every user, process, and system should have only the minimum permissions necessary for its intended function. In practice, this means not running services as root or Administrator when a lower-privilege account will do, regularly reviewing and removing unused accounts and permissions, and separating administrative accounts from everyday user accounts. Privileged Access Management (PAM) solutions enforce and audit high-privilege access in enterprise environments.

Key concepts

+ Phishing: The most common attack vector; targets users via email to steal credentials or install malware.
+ Firewalls: Control traffic between networks; stateful firewalls track connection state, NGFWs add application inspection.
+ Encryption: AES for symmetric, TLS for transport security, RSA/ECC for key exchange and digital signatures.
+ MFA: Multi-factor authentication dramatically reduces the impact of stolen passwords.
+ Least privilege: Grant only the minimum access needed; reduces the blast radius of any compromise.
+ Patch management: Keeping software updated closes the known vulnerabilities that most exploits target.

Frequently asked questions

What is the difference between a vulnerability, an exploit, and a threat?

A vulnerability is a weakness in a system, such as an unpatched software flaw or a misconfigured service. An exploit is a technique or piece of code that takes advantage of a vulnerability. A threat is any potential event or actor that could cause harm. Risk combines the likelihood that a threat will exploit a vulnerability with the potential impact if it does.

What is multi-factor authentication and why does it matter?

Multi-factor authentication (MFA) requires a user to present at least two different types of proof before gaining access: typically something they know (a password), plus something they have (a phone app generating a one-time code) or something they are (a fingerprint). Even if an attacker steals a password, they cannot log in without the second factor. MFA is considered the single most effective control against credential-based attacks.

What is a zero-day vulnerability?

A zero-day vulnerability is a security flaw that is unknown to the software vendor and therefore has no patch available. The term comes from the idea that defenders have had zero days to prepare. Zero-days are especially dangerous because no update can fix them until they are discovered and disclosed, making behavioral detection and network segmentation important compensating controls.

What is the difference between IDS and IPS?

An Intrusion Detection System (IDS) monitors network traffic or system activity and alerts administrators when it detects suspicious patterns, but it does not block traffic on its own. An Intrusion Prevention System (IPS) sits inline in the traffic flow and can actively block or drop suspicious packets. Most modern next-generation firewalls incorporate IPS functionality.

What does a security audit involve?

A security audit assesses an organization's controls against a defined standard or checklist, such as a compliance framework or internal policy. It typically includes reviewing configurations, access rights, patch levels, and logs, and comparing them against best-practice requirements. A penetration test is a related but different activity: rather than checking compliance, a penetration tester actively attempts to exploit weaknesses, simulating what a real attacker would do.