confidentiality
integrity
availability

hardware
software
data

online

phishing

threats

Malware
Insider threats
Phishing attacks
Social engineering

Availability of data
Integrity of data
Confidentiality of data

Legal consequences
Reputational damage
Financial loss

Implementing access control
Performing regular security assessments
Updating software and security patches
Conducting employee security awareness training

Protection of sensitive data
Prevention of financial loss
Avoidance of legal consequences.

Confidentiality ➢ The practice of protecting against unauthorized access to data.
Integrity ➢ The practice of ensuring that data is accurate and has not been tampered with.
Availability ➢ The practice of ensuring that data is available when needed.
Cybersecurity ➢ The practice of protecting internet-connected systems, including hardware, software, and data, from theft, damage, or unauthorized access.
Defense in Depth ➢ A security strategy that involves using multiple layers of security to protect against different types of threats.

Malware ➢ Software that is designed to damage, disrupt, or gain unauthorized access to a computer system.
Phishing attacks ➢ A type of social engineering attack that involves tricking users into providing sensitive information.
Social engineering ➢ The use of deception to manipulate individuals into divulging confidential information.
Authentication ➢ The process of verifying the identity of a user, device, or system.
Encryption ➢ The process of converting plaintext into ciphertext to protect the confidentiality of data.

Risk assessment ➢ The process of identifying, assessing, and prioritizing cybersecurity risks.
Vulnerability ➢ A weakness in a computer system that can be exploited by attackers.
Threat ➢ A potential danger to computer systems or networks.
Cybercrime ➢ Criminal activity carried out using computer systems or networks.
Cybersecurity policy ➢ A set of guidelines and procedures designed to ensure the security of computer systems and networks.

Firewall ➢ A network security device that monitors and controls incoming and outgoing network traffic.
Intrusion detection system (IDS) ➢ A security tool that monitors network traffic for signs of unauthorized access or activity.
Penetration testing ➢ A method of testing a computer system, network, or web application to identify vulnerabilities that could be exploited by attackers.
Access control ➢ The practice of restricting access to resources only to authorized users.
Patch management ➢ The process of maintaining up-to-date software by installing patches and updates to address vulnerabilities.

Cybersecurity incident response plan ➢ A set of procedures designed to respond to cybersecurity incidents in a systematic and organized manner.
Two-factor authentication ➢ A security method that requires users to provide two different types of authentication factors to verify their identity.
Security awareness training ➢ Education and training provided to employees to raise their awareness of cybersecurity risks and best practices.
Data backup and recovery ➢ The process of creating and storing copies of data to protect against data loss or corruption.
Least privilege ➢ The principle that users should be granted only the minimum level of access necessary to perform their job duties.