Cybersecurity Foundations: Essential Concepts and Principles

Foundational Security Concepts: Assets, the CIA Triad, and Security Controls

Understanding cybersecurity starts with knowing what needs protection and why. In this lesson, you will explore how organizations protect their information, systems, people, and business operations. You will learn the core principles behind security decisions and see how they apply through workplace examples and a brief Proxmox demonstration.

What You Will Learn

• Organizational assets: Identify digital, physical, and intangible assets, including data, software, servers, equipment, procedures, and reputation.

• Confidentiality: Understand why sensitive information should be accessible only to authorized individuals.

• Integrity: Learn why data and system configurations must remain accurate and protected against unauthorized or accidental changes.

• Availability: Understand why systems and information must remain accessible when needed, and how backups and redundancy support this goal.

• Security controls: Explore technical protections, administrative policies and procedures, and physical security measures.

• Layered security: Understand why technology, people, and procedures must work together.

• Access management: See how Proxmox users, groups, roles, and permissions connect security concepts to a working environment.

How This Helps You on the Job

These concepts help you make better decisions in IT support, system administration, and cybersecurity. You will understand why access requests require approval, why unexpected changes need investigation, and why system outages can have serious business consequences.

For example, when supporting a payroll system, you need to consider who can view salary information (confidentiality), who can change payment details (integrity), and whether staff can access the system when payroll is due (availability).

The lesson encourages you to ask three important questions:

1. What are we protecting?

2. What could go wrong?

3. Which safeguards would reduce the risk and business impact?

Apply What You Learn

Choose a familiar organization, such as a school, hospital, shop, or training company. Identify three valuable assets. For each asset, describe what could go wrong, which CIA principle would be affected, and one suitable security control.

Remember: one incident can affect more than one CIA principle.

Check Your Understanding

Before moving on, try answering these questions in your own words:

• Why should assets be identified before security tools are selected?

• What is the difference between confidentiality, integrity, and availability?

• How can an accidental change affect integrity?

• Why does an organization need more than firewalls and anti-malware?

• Why should administrator access be restricted to approved responsibilities?

This lesson builds foundational understanding through explanations and a brief demonstration. Detailed configuration and hands-on practice are the next steps in applying these concepts.

Identity and Access Management: Authentication, Authorization, and Accounting

How does an organization verify who you are, decide what you can access, and track what you do? In this lesson, you will explore identity and access management (IAM) and understand how it helps protect the confidentiality, integrity, and availability of business systems and information.

Through workplace examples and a brief Active Directory demonstration, you will connect security principles to user accounts, security groups, application permissions, and activity logs.

What You Will Learn

• Digital identity: Understand how user accounts and system identities represent people and technology within an organization.

• Authentication: Learn how systems verify identity using something you know, something you have, or something you are.

• Multi-factor authentication (MFA): Understand how combining two or more different authentication factors adds protection beyond a password.

• Authorization: Explore how permissions determine what an authenticated user can view, change, delete, or administer.

• Accounting: Learn how activity logs support monitoring, troubleshooting, and security investigations.

• Discretionary access control (DAC): Understand an approach in which resource owners decide who receives access.

• Role-based access control (RBAC): Learn how permissions can be assigned through roles that reflect job responsibilities.

• Attribute-based access control (ABAC): Explore how access decisions can consider factors such as device security, location, and time.

• Non-repudiation: Understand the purpose of strong evidence that supports attributing an action to its originator, including digital signatures.

• Active Directory example: See how adding a user to a security group can support application access when the application is configured to recognize that group.

How This Helps You on the Job

These concepts support everyday tasks in IT support, system administration, identity management, and cybersecurity.

You will understand how to distinguish a login problem from a permissions problem, why users should receive only the access required for their responsibilities, and how logs help investigate unexpected activity.

For example, an employee might successfully sign in to a payroll application but be unable to edit payment records. Authentication has succeeded, while authorization limits the employee’s actions. Relevant audit logs can record permitted changes and denied attempts, depending on the application’s logging configuration.

This knowledge helps you approach workplace situations such as:

• Setting up access for a new employee.

• Investigating “access denied” messages.

• Reviewing security group membership.

• Supporting users with MFA.

• Recognizing excessive permissions.

• Investigating suspicious login attempts or application changes.

• Understanding why an insecure device may be blocked even when the correct credentials are provided.

Important Points to Remember

• Authentication: Who are you?

• Authorization: What are you allowed to do?

• Accounting: What activity was recorded?

• Two passwords do not provide two different authentication factors.

• Successful authentication does not mean unrestricted access.

• Logging must be configured appropriately; do not assume every action is recorded automatically.

• Logs identify activity associated with an account. If that account is compromised, additional evidence is needed to determine who actually performed the action.

Apply What You Learn

Imagine a new employee joins the finance team. They need to view invoices but should not change payment details or manage user accounts.

Describe:

1. How the employee should authenticate.

2. Which role or security group should provide the approved access.

3. Which actions should be permitted and restricted.

4. Which activities should be logged.

5. How device security or login location could influence access.

Then consider what could happen if the employee were accidentally given administrator permissions.

Check Your Understanding

Before moving on, try answering these questions in your own words:

• How is authentication different from authorization?

• Why does MFA provide more protection than a password alone?

• Why is giving users unnecessary permissions a security risk?

• How do DAC, RBAC, and ABAC differ?

• Why are logs useful during a security investigation?

• Why does activity recorded under an account not always prove that the account owner performed it?

This lesson develops the understanding needed to make informed identity and access decisions. The Active Directory demonstration illustrates the concepts; it is not a complete IAM configuration lab.

Networking Fundamentals for Security: Packet Flow, Segmentation, and Trust Boundaries

Understanding how devices communicate is essential to protecting them. In this lesson, you will explore how data travels across networks, how network design influences security, and how organizations can limit an attacker’s movement after a device is compromised.

Through workplace examples and a visual network topology demonstration, you will follow traffic between computers, switches, servers, wireless access points, and the internet.

What You Will Learn

• Network fundamentals: Understand how connected systems exchange information and support everyday business activities.

• Network components: Explore the roles of switches, routers, firewalls, and wireless access points.

• Packets and data flow: Learn how information travels in smaller units, including source and destination information and the data being carried.

• Wired and wireless networks: Understand their connectivity methods, practical differences, and security considerations.

• Network topology: Follow visual examples of connectivity checks, remote administration, and web browsing.

• Physical segmentation: Understand how separate networking equipment can help isolate systems with different security needs.

• Logical segmentation: Explore how VLANs and traffic-control policies separate systems while sharing physical infrastructure.

• Security zones and trust boundaries: Learn how organizations group systems and control communication between areas with different security requirements.

• The OSI model: Gain a high-level introduction to its seven layers and understand why security professionals refer to different layers when discussing protections.

• North-south and east-west traffic: Distinguish traffic entering or leaving a network environment from communication between systems within it.

• Limiting attacker movement: Understand why protecting internal traffic matters alongside securing the internet boundary.

How This Helps You on the Job

These concepts help you understand connectivity problems, communicate with network teams, and recognize weaknesses in how systems are connected.

In IT support, you may investigate why a user can access the internet but cannot reach a shared printer or file server. Understanding the traffic path helps you consider where connectivity or access restrictions could be affecting the request.

In cybersecurity or system administration, you may need to explain why guest Wi-Fi, employee computers, public-facing servers, and critical systems should have different access rules.

This knowledge supports workplace tasks such as:

• Reading a basic network diagram.

• Understanding how requests travel from a workstation to a server.

• Recognizing the purpose and limits of connectivity checks such as ping.

• Discussing VLANs, firewall rules, and security zones with network administrators.

• Identifying unnecessary communication between systems.

• Understanding how segmentation can reduce the impact of a compromised device.

• Considering how security changes could affect legitimate business traffic.

A Workplace Example

A company provides guest Wi-Fi, employee workstations, an internal file server, and a public-facing website.

These systems have different communication needs. Guests need internet access but should not be able to browse internal company files. Employees may need approved access to the file server. The public-facing web server should communicate only with the internal services required to operate the website.

If the web server is compromised, properly enforced segmentation can help prevent the attacker from using it to reach unrelated employee computers or sensitive file shares.

Important Points to Remember

• A device being inside the company network does not automatically make its traffic safe.

• Wired connections still require security protections; physical cables alone do not prevent attacks.

• Wireless signals can extend beyond a building, making authentication and appropriate network separation important.

• VLANs provide logical separation, while routing and firewall policies determine which communication is permitted between them.

• A failed ping does not necessarily mean a device is offline; the device or a firewall may block ping traffic.

• Segmentation reduces opportunities for attacker movement, but it must be correctly configured and maintained.

• Security controls should protect systems while allowing the communication needed for business operations.

Apply What You Learn

Sketch a simple office network containing employee computers, guest Wi-Fi, a printer, a file server, and an internet connection.

Then answer:

1. Which devices need to communicate with each other?

2. Which connections should be restricted?

3. Which systems should belong to separate security zones?

4. Where would you place controls to enforce those restrictions?

5. If one employee computer were compromised, what could limit the attacker’s access to other systems?

Focus on explaining your decisions. You do not need to configure networking equipment for this activity.

Check Your Understanding

Before moving on, try answering these questions in your own words:

• What is a packet, and why does its journey matter for security?

• How do wired and wireless connections differ?

• What is the difference between physical and logical segmentation?

• Why would an organization separate a public-facing server from employee computers?

• What is a trust boundary?

• How does east-west traffic differ from north-south traffic?

• Why is an internet-facing firewall alone insufficient to protect all internal communication?

• How does the OSI model help professionals discuss network security?

This lesson builds conceptual understanding through explanations and a visual demonstration. It prepares you to study IP addresses, ports, and protocols in the next module.

Network Communication and Protocols: IP Addresses, DNS, DHCP, Ports, and Secure Connections

How does your computer find a website, connect to a file server, or communicate securely with another office? In this lesson, you will explore the addressing, services, and protocols that make network communication possible.

Through workplace examples, a visual network topology, and demonstrations using Windows commands and browser connections, you will learn how these concepts support troubleshooting and cybersecurity.

What You Will Learn

• IP addressing: Understand how IP addresses identify network interfaces and help devices send traffic to the intended destination.

• IPv4 and IPv6: Recognize their different address formats and understand why security teams must consider both.

• MAC addresses and frames: Gain a brief introduction to how local network communication relates to the data link layer.

• DNS: Learn how the Domain Name System resolves names to IP addresses and why incorrect or compromised DNS information can disrupt or redirect communication.

• DHCP: Understand how devices automatically receive network settings, including an IP address, subnet mask, default gateway, and DNS server information.

• Ports and protocols: Distinguish the service endpoint a device communicates with from the rules governing that communication.

• TCP and UDP: Explore their different approaches to data delivery and why applications use them for different purposes.

• Common network services: Recognize protocols used for web browsing, file sharing, remote administration, and network monitoring.

• Secure communication: Compare HTTP with HTTPS, FTP with SFTP, and Telnet with SSH.

• Network Address Translation (NAT): Understand how private addressing and address translation support communication with external networks.

• TLS, IPsec, and VPNs: Explore how encryption helps protect data traveling between systems, remote workers, and office locations.

• Practical demonstrations: See how ipconfig displays network configuration and how netstat provides visibility into connections and listening ports.

How This Helps You on the Job

These concepts help you investigate connectivity issues, understand firewall requests, recognize unnecessary service exposure, and explain why sensitive communication needs protection.

For example, if an employee cannot access a shared resource, you can consider several different causes: incorrect network settings, a DNS problem, a service that is not listening, or a firewall restriction. Understanding these differences helps you gather useful evidence and escalate the issue clearly.

This knowledge supports workplace tasks such as:

• Checking a computer’s IP address and DNS configuration.

• Distinguishing address assignment problems from name resolution problems.

• Understanding which service a connection may be using.

• Reviewing whether a system needs its exposed services.

• Recognizing the risks of unencrypted administrative access.

• Discussing secure file transfers and remote connectivity.

• Understanding why DNS and DHCP require careful protection.

Common Ports to Recognize

These are common defaults. Services can be configured to use different ports.

• 80 — HTTP: Web communication without TLS protection.

• 443 — HTTPS: Web communication protected using TLS.

• 21 — FTP: FTP control connection; file transfers also use separate data connections.

• 22 — SSH and SFTP: Secure remote administration and SSH-based file transfer.

• 23 — Telnet: Remote terminal access without built-in encryption.

• 53 — DNS: Name resolution.

• 161 — SNMP: Network monitoring and management queries.

• 445 — SMB: Commonly used for Windows network file sharing.

A Workplace Example

An employee can reach an internal server using its IP address, but a name-based connectivity test fails.

This suggests that DNS resolution may be involved. Within your authorized role, check the employee’s DNS settings, compare the resolved address with the expected address, and document the results before escalating or making approved changes.

If the employee also has incorrect IP or gateway information, DHCP configuration may need investigation. These are related services, but they perform different jobs.

Important Points to Remember

• DNS resolves names; DHCP supplies network configuration.

• A port number is a clue about a service, not proof of which protocol is running.

• An open port does not automatically mean a system is vulnerable. The service, its configuration, access restrictions, and patch status matter.

• TCP provides reliable, ordered delivery to applications. UDP does not provide those guarantees itself.

• File transfers do not all use FTP. Windows shared folders commonly use SMB, while SFTP transfers files over SSH.

• HTTPS protects communication, but it does not guarantee that a website’s content or business is trustworthy.

• Certificate warnings require investigation because encryption alone does not establish that you are communicating with the intended server.

• NAT translates addresses; it does not replace firewall rules, authentication, or endpoint protection.

• Secure protocols still require appropriate configuration and access controls.

Apply What You Learn

Imagine an employee needs to access a company website, open a shared folder, and remotely administer a server.

For each task, identify:

1. How the destination’s IP address could be found.

2. Which protocol and common port might be involved.

3. Whether the communication is encrypted.

4. Which access restrictions should apply.

5. What information you would collect if the connection failed.

Use your notes to explain why reaching a device and successfully using its application are different things.

Check Your Understanding

Before moving on, try answering these questions in your own words:

• How do IPv4 and IPv6 differ?

• What is the difference between an IP address, a port, and a protocol?

• How do DNS and DHCP support network communication?

• What risks could a rogue DHCP server introduce?

• Why should unnecessary listening services be disabled or restricted?

• Why is SSH preferable to Telnet for remote administration?

• Why does a familiar port number not guarantee secure communication?

• How do TLS and IPsec help protect data in transit?

This lesson builds foundational knowledge through explanations and demonstrations. It prepares you to connect network behavior with the threats and security concepts introduced in the following modules.

Threat Actors and Motivations: Understanding Who Targets an Organization and Why

Effective cybersecurity requires understanding the people and groups behind attacks. In this lesson, you will explore different threat actors, their motivations, and how their goals and capabilities influence an organization’s security decisions.

Through workplace scenarios, you will connect threats such as data theft, ransomware, espionage, disruption, and insider misuse to the assets and business operations that need protection.

What You Will Learn

• Threat actors: Understand how individuals and groups differ in their skills, resources, access, and objectives.

• Nation-state actors: Explore government-backed threats associated with espionage, strategic objectives, and disruption.

• Organized cybercrime: Learn how financially motivated groups use fraud, data theft, extortion, and ransomware.

• Hacktivists: Understand how political or social motivations can lead to website defacement, information leaks, or service disruption.

• Insider threats: Recognize how employees, contractors, and other trusted users can cause harm through intentional actions or accidental mistakes.

• Inexperienced attackers: Learn why people using ready-made attack tools can still cause damage by exploiting common weaknesses.

• AI-assisted threats: Explore the instructor’s discussion of how AI tools may reduce the effort needed to create or adapt malicious content and tools.

• Internal and external threats: Understand why security must address both outside attackers and risks involving existing access.

• Attack motivations: Distinguish financial gain, espionage, disruption, ideology, and revenge.

• Defensive priorities: Connect likely threats to protections such as patching, least privilege, monitoring, segmentation, and protected backups.

How This Helps You on the Job

These concepts help you explain why particular assets need protection and why security controls should reflect the organization’s risks.

In IT support, you may handle reports of suspicious activity, excessive permissions, or employees transferring work files to personal devices. In system administration, you may support account offboarding, patching, and backup protection. In cybersecurity, you may help investigate activity and assess how it could affect the business.

This knowledge supports workplace tasks such as:

• Recognizing that legitimate access can still be misused.

• Understanding why employee and contractor permissions require review.

• Supporting timely account removal through approved offboarding procedures.

• Explaining why sensitive information should remain in approved systems.

• Connecting ransomware risks to recovery planning and segmentation.

• Understanding why public-facing websites and social media accounts need protection.

• Reporting suspicious behavior using evidence rather than assumptions.

• Explaining security priorities in terms of business impact.

A Workplace Example

An employee copies confidential customer records to a personal USB drive so they can continue working at home.

Their intention may be to finish a task, but the action can still expose company information. The drive could be lost, or the personal computer could lack appropriate protection.

This illustrates an unintentional insider risk. Relevant safeguards include clear data-handling procedures, approved remote-working tools, appropriate access permissions, and monitoring of sensitive data transfers.

Compare this with an employee deliberately taking the same records to sell them. The information at risk is similar, but the intent and investigation are different.

Connecting Motivations to Defenses

• Financial gain: Consider protections against account compromise, fraud, data theft, and ransomware, supported by protected backups and recovery procedures.

• Espionage: Consider restricted access to sensitive information, monitoring for unusual activity, and investigation of suspicious data transfers.

• Disruption: Consider service availability, segmentation, redundancy, and recovery planning.

• Ideology or publicity: Consider protection of websites, public accounts, sensitive information, and online services.

• Revenge or deliberate insider misuse: Consider least privilege, activity logging, and coordinated access removal when responsibilities or employment change.

These priorities complement a common security baseline; an organization may face several motivations at the same time.

Important Points to Remember

• Threat actor categories can overlap. One group may pursue several objectives.

• A motivation can help explain an attack, but it does not prove who carried it out.

• Inexperienced attackers can still exploit unpatched systems or weak configurations.

• Insider risk includes accidental actions as well as deliberate misuse.

• Internal access does not automatically make every action appropriate or safe.

• Security investigations should focus on evidence and behavior. Disagreement or dissatisfaction alone does not establish malicious intent.

• Least privilege limits the damage that mistakes, compromised accounts, or deliberate misuse can cause.

• Protecting confidentiality, integrity, and availability remains the goal across all threat categories.

Apply What You Learn

Choose a familiar organization, such as a school, hospital, bank, or training company.

Identify:

1. Three assets that would be valuable to an attacker.

2. Two possible threat actor categories.

3. What each actor might want to achieve.

4. How an attack could affect confidentiality, integrity, or availability.

5. Three safeguards that would help reduce the risk.

Include one scenario involving an accidental action by an authorized user.

Check Your Understanding

Before moving on, try answering these questions in your own words:

• What is a threat actor?

• How can an attacker’s motivation influence their choice of target?

• How do financially motivated attacks differ from espionage?

• Why might an attacker seek publicity while another tries to remain hidden?

• Why can insider threats be difficult to detect?

• How does least privilege reduce both accidental and intentional harm?

• Why should organizations address basic weaknesses even when facing sophisticated attackers?

• Why is evidence necessary before attributing an incident to a particular person or group?

This lesson builds the understanding needed to connect potential adversaries with appropriate defensive priorities. It prepares you to explore how attackers carry out their attacks in the next module.

Attack Vectors and Attack Surfaces: Understanding How Attackers Gain Access

How do attackers find a way into an organization, and how can security teams reduce those opportunities? In this lesson, you will explore attack vectors, attack surfaces, social engineering, and third-party risks.

Building on the previous lesson about threat actors and motivations, this module explains how to assess potential entry points and choose protections that match an organization’s actual systems, people, and business needs.

What You Will Learn

• Attack vectors: Understand the methods or paths attackers use to gain unauthorized access, such as phishing, exploiting vulnerable software, or abusing weak credentials.

• Attack surfaces: Identify the collection of potential entry points across applications, networks, accounts, devices, people, and physical locations.

• Asset inventory: Learn why understanding what an organization uses is essential before choosing security controls.

• Reducing exposure: Explore disabling unused services, removing unnecessary software, restricting network access, and limiting publicly accessible systems.

• Common weaknesses: Recognize risks involving default credentials, unpatched software, insecure configurations, exposed services, and insufficient segmentation.

• Removable media: Understand how USB drives and other storage devices can introduce malware or expose sensitive information.

• Shadow IT: Learn how unapproved software, cloud services, and devices create risks that IT and security teams may not know about.

• Social engineering: Explore how attackers exploit trust, urgency, and apparent authority to influence people.

• Common social engineering methods: Recognize phishing, vishing, impersonation, tailgating, piggybacking, and shoulder surfing.

• Supply chain and vendor risks: Understand how suppliers, software providers, and managed service providers can introduce indirect risks.

• Typosquatting and watering hole attacks: Learn how deceptive domains and compromised websites can be used to target users.

How This Helps You on the Job

These concepts help you assess why a system is exposed, identify unnecessary risks, and explain how a proposed security control addresses a specific problem.

In IT support, you may encounter employees installing unapproved software, receiving suspicious support calls, or connecting unknown devices. In system administration, you may review services, remove unused applications, and secure remote access. In cybersecurity, you may assess exposed assets and prioritize improvements.

This knowledge supports workplace tasks such as:

• Maintaining an accurate inventory of devices, applications, and services.

• Identifying unnecessary remote access or listening services.

• Checking that shared default passwords have been changed.

• Supporting patching and vulnerability management.

• Recognizing suspicious requests for credentials, files, or remote access.

• Explaining why approved software and devices matter.

• Reviewing vendor access and the information third parties handle.

• Connecting technical controls, employee training, and physical security.

A Workplace Example

An employee receives a call from someone claiming to work for the company’s IT support provider. The caller says there is an urgent security problem and asks the employee to install remote-access software and provide a connection code.

The attacker is using impersonation and vishing as attack vectors. The employee’s phone contact, trust in the provider, and ability to install software contribute to the potential attack surface.

The employee should verify the request through an established support channel using known contact details, rather than relying on information supplied by the caller. Approved support procedures, software installation restrictions, and employee awareness can help prevent unauthorized access.

Important Points to Remember

• Attack surface: Where an attacker may be able to interact with or enter an environment.

• Attack vector: How an attacker attempts to exploit that opportunity.

• Vulnerability: A weakness that could be exploited.

• Email is part of an attack surface; a phishing message is an attack vector.

• An exposed service is not automatically vulnerable, but it needs a business purpose and appropriate protection.

• Removing unnecessary services reduces exposure. Securing required services helps manage the risk that remains.

• Shadow IT can arise from employees trying to complete their work, without malicious intent.

• Unknown removable media can introduce risk, but connecting a storage device does not automatically mean malware will execute.

• A vendor incident can affect your organization, depending on the vendor’s access, the services involved, and your safeguards.

• Attack surface management is continuous because systems, users, software, and business relationships change.

Apply What You Learn

Imagine a training company has a public website, an LMS, employee email accounts, office Wi-Fi, staff laptops, and an external IT provider.

Choose three of these areas. For each one, identify:

1. What is exposed or accessible.

2. One possible attack vector.

3. A weakness that could make the attack successful.

4. The potential effect on confidentiality, integrity, or availability.

5. A safeguard that would reduce the risk.

For example, a staff laptop with unnecessary remote-access software creates additional exposure. Removing that software through an approved process reduces the attack surface.

Check Your Understanding

Before moving on, try answering these questions in your own words:

• How does an attack vector differ from an attack surface?

• Why should asset discovery come before selecting security tools?

• How can unused software or services increase risk?

• Why are default credentials dangerous?

• What makes an application or device “shadow IT”?

• How do urgency and apparent authority support social engineering?

• How can physical access weaknesses lead to cybersecurity incidents?

• Why should vendor access be included in a security assessment?

• How does typosquatting differ from a watering hole attack?

• Why must attack surface assessments be repeated over time?

This lesson develops a systematic approach to identifying exposure and matching safeguards to real business needs. It prepares you to evaluate security risks across technology, people, physical access, and third-party relationships.

Vulnerabilities and Mitigation: Identifying, Prioritizing, and Reducing Security Risks

Finding a security weakness is only the beginning. Security teams must determine whether it affects their environment, how urgently it needs attention, and how to address it without disrupting essential services.

In this lesson, you will explore vulnerabilities across applications, operating systems, hardware, cloud environments, and business processes. You will learn how vulnerability management combines technical tools, human judgment, and ongoing verification to reduce risk.

What You Will Learn

• Vulnerabilities: Understand how weaknesses in software, firmware, hardware, configurations, and processes can affect confidentiality, integrity, and availability.

• Application weaknesses: Explore how unsafe handling of user input and coding flaws can create opportunities for exploitation.

• Operating system and hardware risks: Understand why operating systems, firmware, and physical equipment also require security attention.

• Cloud and virtualization risks: Recognize that cloud services and hypervisors still require appropriate configuration and maintenance.

• Zero-day and known vulnerabilities: Understand the distinction between newly discovered weaknesses without an available fix and publicly documented vulnerabilities.

• CVE records and vendor advisories: See how vulnerability identifiers and supporting documentation help teams understand affected products, potential impact, and available fixes.

• Vulnerability management: Learn the continuous cycle of identifying, prioritizing, addressing, and verifying vulnerabilities.

• Scanning and human analysis: Understand why scanner findings require review for applicability, false positives, and business context.

• Patch management: Explore testing, maintenance windows, change coordination, and rollback planning.

• Mitigation strategies: Connect least privilege, secure configuration standards, and network segmentation to reducing security risks.

How This Helps You on the Job

These concepts help you turn vulnerability findings into practical actions. You will understand why a scan report is a starting point, why some findings need attention before others, and why installing an update does not complete the job until the result is verified.

In IT support, you may help deploy updates and confirm that applications still work. In system administration, you may schedule maintenance, enforce configuration settings, and restrict access. In cybersecurity, you may review findings, coordinate remediation, and track unresolved risks.

This knowledge supports workplace tasks such as:

• Reading a vulnerability report and checking which systems are affected.

• Using CVE identifiers to locate relevant vendor guidance.

• Distinguishing a software flaw from an insecure configuration.

• Prioritizing findings based on exposure, exploitability, and business impact.

• Coordinating fixes with system owners and administrators.

• Documenting temporary protections when an immediate fix is not possible.

• Rescanning systems and collecting evidence that an issue has been addressed.

• Explaining security risks and operational trade-offs clearly.

The Vulnerability Management Cycle

1. Identify: Discover weaknesses through scanning, configuration reviews, vendor advisories, and other assessments.

2. Prioritize: Confirm that findings apply and assess their urgency using technical severity, system exposure, existing protections, and asset importance.

3. Address: Apply an appropriate fix, change a configuration, remove an unnecessary component, or implement a mitigation.

4. Verify: Rescan or perform suitable checks to confirm that the action worked and essential services still function.

5. Repeat: Continue monitoring because systems change and new vulnerabilities are discovered.

A Workplace Example

A vulnerability scan identifies a serious weakness in an internet-facing application. Another finding affects an internal system with tightly restricted access.

The team should assess both findings, including whether exploitation is possible, what information or services are at risk, and which protections already exist. The internet-facing application may need faster attention because attackers can reach it more easily.

Before applying its patch, the team reviews vendor guidance, tests where practical, plans the change, and prepares a recovery option. After deployment, it verifies the fix and checks that the application still works.

If the patch cannot be applied immediately, temporary access restrictions or other suitable safeguards may reduce exposure while the permanent fix is scheduled.

Important Points to Remember

• Remediation addresses the underlying weakness, such as applying a corrective patch or fixing an insecure setting.

• Mitigation reduces the likelihood or impact of exploitation, even when the weakness remains.

• A vulnerability does not automatically mean that a system has already been compromised.

• A specific vulnerability can be eliminated, but maintaining an environment with no security risk is not a realistic ongoing guarantee.

• Scanner severity and organizational priority are related but different. Document the context behind prioritization decisions.

• A zero-day is not necessarily known only to an attacker; researchers or vendors may also know about it before a fix is available.

• Installing a patch is not the same as verifying successful remediation.

• Least privilege limits what compromised accounts and processes can do.

• Segmentation can restrict access to a vulnerable system, but it does not repair the vulnerability.

• Secure baselines should reflect system roles, with justified exceptions documented and reviewed.

Apply What You Learn

Imagine you receive these three findings:

• A public-facing application is missing a security update.

• An employee account has unnecessary administrator permissions.

• A legacy system cannot be patched immediately because it supports an essential business process.

For each finding, explain:

1. What additional information you need.

2. What could happen if the weakness is exploited.

3. How you would determine its priority.

4. Which remediation or mitigation could help.

5. How you would verify the result.

Focus on explaining your decisions rather than assuming every finding needs the same response.

Check Your Understanding

Before moving on, try answering these questions in your own words:

• What is a vulnerability, and where can vulnerabilities exist?

• How does remediation differ from mitigation?

• Why are CVE records and vendor advisories useful?

• Why do vulnerability scan results require human review?

• Which factors influence remediation priority?

• Why should patches be tested and coordinated with system owners?

• What should happen after a fix is applied?

• How can least privilege and segmentation reduce the impact of exploitation?

• Why is vulnerability management a continuous process?

This lesson builds the reasoning needed to manage vulnerabilities responsibly. It includes a walkthrough of vulnerability documentation and a conceptual segmentation example, preparing you for more detailed scanning, patching, and remediation practice.

How Cyberattacks Work: Exploits, Credential Attacks, and Malware

This lesson explores how attackers take advantage of weaknesses in accounts, applications, networks, and user behavior. You will connect the concepts of attack surfaces, attack vectors, vulnerabilities, and exploits, then examine common attacks that security teams encounter in the workplace.

The video covers credential attacks, application attacks, denial-of-service attacks, malware, and social engineering. It also explains how multiple security controls work together to help prevent attacks, detect suspicious activity, and support recovery.

What You Will Learn

By the end of this lesson, you should be able to:

• Explain the relationship between a vulnerability, an exploit, and a payload.

• Distinguish brute-force attacks, password spraying, and credential stuffing.

• Describe the difference between online password guessing and offline attempts to crack stolen password hashes.

• Recognize how stolen credentials and session information can allow unauthorized access.

• Explain how injection attacks and buffer overflows can affect applications.

• Describe how denial-of-service and distributed denial-of-service attacks affect availability.

• Explain how attackers use botnets made up of compromised devices.

• Recognize the characteristics of ransomware, Trojans, spyware, worms, and rootkits.

• Describe how social engineering exploits trust, urgency, and perceived authority.

• Explain why organizations combine identity controls, secure coding, patching, monitoring, endpoint protection, and recovery planning.

How This Helps You on the Job

Understanding attack methods helps you recognize suspicious activity, ask better investigation questions, and select controls that address the actual threat.

For example, repeated failed sign-ins against one account may suggest password guessing. Attempts using a common password across many accounts may suggest password spraying. Attempts using previously leaked username-and-password combinations may indicate credential stuffing. These patterns require investigation; a failed login alone does not prove an attack.

This knowledge supports tasks such as:

• Reviewing authentication logs and investigating unusual account activity.

• Helping users adopt unique passwords, password managers, and multifactor authentication.

• Working with developers and vendors to remediate application weaknesses.

• Investigating unusual network traffic or unexpected device behavior.

• Responding to endpoint alerts and escalating suspected malware infections.

• Explaining why segmentation, least privilege, and protected backups matter.

• Helping employees recognize suspicious requests and verify them through trusted channels.

A Workplace Example

Several employees report unexpected sign-in notifications. Authentication logs show failed login attempts across many accounts, followed by a successful login from an unfamiliar location.

A security analyst investigates whether the pattern suggests password spraying, credential stuffing, or legitimate activity. The analyst reviews the affected account’s activity, checks for suspicious session use, and follows the organization’s response procedures.

The response may include restricting access, revoking sessions, resetting compromised credentials, and reviewing authentication controls. The investigation also helps identify improvements in monitoring, password practices, and employee reporting.

This example shows how understanding attack techniques helps turn an alert into a focused investigation.

Important Points to Remember

• Vulnerabilities, exploits, and payloads are different. A vulnerability is a weakness. An exploit takes advantage of a weakness. A payload is the code or action delivered as part of an attack.

• Not every attack requires malware. Attackers may use stolen credentials, existing tools, or deception to gain access.

• Password attacks require different defenses. Rate limiting can reduce online guessing, but it does not stop offline cracking of stolen password hashes. Unique passwords reduce the risks associated with password reuse.

• Multifactor authentication adds protection. It reduces many account-compromise risks, but organizations still need monitoring and secure session handling.

• Application security requires appropriate technical fixes. Secure coding, safe handling of input, testing, and updates address weaknesses more effectively than simply blocking special characters.

• An outage does not automatically mean an attack. Legitimate demand, technical failures, and malicious traffic can all affect availability.

• Malware categories can overlap. A malicious program may steal information, spread to other systems, and deploy ransomware.

• Recovery requires preparation. Protected, tested backups support recovery from ransomware, but they do not prevent data theft. Recovery should follow containment and remediation.

• Defense in depth combines controls. No single security product can prevent or detect every attack.

Apply What You Learn

Imagine an employee opens an unexpected attachment. Their computer begins behaving unusually, and monitoring shows increased outbound traffic.

Consider:

1. What information would you collect before deciding what happened?

2. Which endpoint and network records could help investigate the activity?

3. What containment actions would your organization’s procedures permit?

4. How could segmentation and least privilege limit the impact?

5. What would need to be checked before returning the device to normal use?

Check Your Understanding

1. How does an exploit differ from a vulnerability?

2. What distinguishes brute force, password spraying, and credential stuffing?

3. Why does password reuse increase risk?

4. How do injection attacks differ from buffer overflows?

5. What makes a distributed denial-of-service attack different from a denial-of-service attack originating from one source?

6. How does a worm differ from a Trojan?

7. Why are backups only one part of ransomware preparedness?

8. How do employee awareness and technical controls support each other?

This lesson builds practical understanding of common attack methods and their defenses through explanations and examples.