Network and cyber security

Cyber security protects information systems, networks, devices and data from unauthorised access, misuse, disruption, alteration or destruction. Network security focuses on traffic, hosts, users, protocols and devices connected through LANs, WANs or the internet. For objective exams, the starting point is the CIA triad: confidentiality, integrity and availability. Confidentiality keeps data secret from unauthorised users, integrity keeps data accurate and unaltered, and availability keeps systems usable when needed. A fee-payment portal, result server or school network fails security if any one of these three goals is broken.

Security controls are usually grouped as preventive, detective and corrective controls. Preventive controls include authentication, access control, encryption and secure configuration. Detective controls include logging, intrusion detection, antivirus alerts and audit trails. Corrective controls include backup restoration, patching after compromise and incident response. The attack surface is the set of points through which an attacker can enter or affect a system: open ports, weak passwords, outdated software, exposed APIs, removable media and social engineering channels. Threat is a possible danger, vulnerability is a weakness, exploit is a method of using that weakness, and risk combines likelihood with impact.

Exam cue: confidentiality asks "who can see it", integrity asks "who can change it", and availability asks "can authorised users still use it".