Session 2: Cyber Fundamentals Part 2

Overview

This session continued the cybersecurity fundamentals covered in Session 1: Cyber Fundamentals Part 1.

We reviewed how to access Study Buddy sessions before moving through the course material.

The session covered several important areas, including the CIA and DAD triads, security governance, policies and standards, information security, exposed systems, vulnerability management, risk, device security, DDoS mitigation, and the balance between security, usability and functionality.

A recurring theme throughout the session was that cybersecurity is not achieved through technology alone. Policies, procedures, standards, training and human decision-making all contribute to an organisation’s overall security posture.

Cybersecurity Breaches and Staying Informed

We discussed examples of significant UK security breaches and the idea that:

Every company is one mistake away from being breached.

I understood this as a reminder that even organisations with significant security resources can still be affected by a single mistake, overlooked vulnerability or successful attack.

We were encouraged to keep up with current cybersecurity developments through reputable industry sources, and we were shown The Register.

This highlighted the importance of continuously following security news rather than treating cybersecurity knowledge as something that remains static.

The CIA Triad

We revisited the CIA Triad, which describes three fundamental objectives of information security:

• Confidentiality – ensuring information is only accessible to authorised people.
• Integrity – protecting information from unauthorised modification.
• Availability – ensuring systems and information remain accessible when required.

Encryption was discussed as one method of supporting confidentiality because it helps protect information from being read by unauthorised parties.

Security Governance

We discussed how organisations use governance to establish how security should be managed.

Governance provides the overall framework within which security decisions are made and helps define responsibilities, rules and expectations across an organisation.

As part of this discussion, we looked at examples of security policies and standards used within large organisations and public-sector environments, including guidance relating to the use of artificial intelligence.

One important point was the need to consider how and where information is processed when using cloud-based AI services, particularly when handling personal, confidential or organisational data.

My main takeaway was that sensitive information should not be entered into an AI system without first considering the organisation’s policies, data classification requirements and relevant legal obligations, including UK GDPR.

Policies, Standards, Procedures and Guidelines

We explored the differences between several types of organisational security documentation.

Policies

Policies establish the rules and expectations that users are expected to follow.

They define what is and is not permitted within an organisation and support the wider governance structure.

Standards

Standards define specific requirements or recognised practices that organisations may adopt.

We discussed ISO/IEC 27001, one of the most widely recognised information security management standards.

Achieving certification can require significant time and investment, but it can also demonstrate that an organisation has taken a structured approach to managing information security.

Procedures

Procedures provide step-by-step instructions explaining how particular tasks should be performed.

While a standard may define what must be achieved, a procedure explains how it should be carried out.

Guidelines

Guidelines provide recommended practices and suggestions.

They can help users make appropriate decisions where a mandatory policy or procedure may not specify every possible situation.

Information Security

Information security brings together policies, processes and technical controls throughout a lifecycle in order to protect information.

An important point raised during the session was that technical standards and controls can only achieve so much if people are not properly trained.

A secure organisation therefore depends on a combination of:

People + Processes + Technology

This connects directly with the ideas introduced during Session 1.

The DAD Triad

In this session, the DAD Triad — denial wording was presented as three ways in which information or systems can be compromised:

• Disclosure – information is exposed to an unauthorised party.
• Alteration – information is changed without authorisation.
• Denial – legitimate users are prevented from accessing information or services.

These concepts can be compared directly with the CIA Triad.

Disclosure threatens confidentiality, alteration threatens integrity, and denial threatens availability.

Disclosure and Exposed Systems

To show how internet-facing systems and services can become visible, the instructor demonstrated Shodan, and I also used it during the session.

Shodan is a search engine that indexes internet-connected devices and services. It can reveal publicly accessible systems such as servers, networking equipment, Internet of Things devices and other exposed services.

The demonstration was particularly useful because it showed how much information can become publicly visible when systems or devices are not securely configured.

Practical Example – Shodan

A demonstration involving internet-connected cameras was particularly memorable because it illustrated the real-world consequences of insecure configuration.

It reinforced the importance of securely configuring internet-connected devices, reducing unnecessary exposure and understanding which services can be reached from outside an organisation’s network.

We were also introduced to other tools and services associated with internet exposure and breached data, including:

• FOFA
• DeHashed
• Have I Been Pwned
• BreachDirectory

These examples demonstrated how information exposed through poor configuration or data breaches can potentially be discovered by third parties.

Alteration

The second element of the DAD Triad is alteration.

Alteration occurs when information is changed without appropriate authorisation.

This could include changes to files, database records, website content or system configurations.

Protecting integrity therefore requires controls that prevent unauthorised changes and allow organisations to detect when changes have occurred.

Denial

The final element of the DAD Triad is denial.

Denial occurs when legitimate users are prevented from accessing systems, services or information.

A common example is a Distributed Denial of Service (DDoS) attack, where large volumes of traffic are directed towards a service in an attempt to overwhelm the resources available to it.

Securing Devices

We discussed several basic practices that can significantly improve device security.

These included:

• Using a standard user account rather than routinely working with administrative privileges, following least privilege.
• Using strong passwords or passphrases.
• Keeping operating systems and applications updated.
• Protecting devices against malware.
• Enabling and correctly configuring firewalls.

We also reflected on how consistently these practices are applied in real-world environments.

This highlighted the difference between knowing a security recommendation and applying it consistently in practice.

Zero-Day Vulnerabilities

We discussed zero-day vulnerabilities.

A zero-day vulnerability is a security weakness that is unknown to the vendor or does not yet have an available fix when it becomes exploitable.

We were introduced to the National Vulnerability Database (NVD) maintained by NIST, which provides information about publicly disclosed vulnerabilities.

A simple analogy was used involving discovering that a bank had accidentally left a door unsecured.

Someone discovering the problem could report it so that it could be corrected, or they could attempt to take advantage of it.

The example reinforced an important cybersecurity principle: discovering a weakness does not provide permission to exploit it.

Authorisation and ethical conduct remain essential when investigating vulnerabilities.

AI and the Future of Cybersecurity

I raised a question about how resilient cybersecurity as a profession may be as artificial intelligence becomes increasingly capable.

The discussion focused on the limitations of AI in understanding organisational boundaries, context, responsibility and acceptable risk in the same way that experienced security professionals can.

There is also the practical question of how much access an organisation should provide to an AI system when internal networks or sensitive information are involved.

My takeaway was that AI is likely to become an increasingly powerful cybersecurity tool, but human judgement, accountability and contextual understanding will continue to be important.

Security, Usability and Functionality

We discussed the SUF Triad:

• Security
• Usability
• Functionality

These three areas need to be balanced when designing and securing systems.

Increasing security can sometimes reduce usability, while prioritising convenience or functionality can introduce additional risk.

Accessibility must also form part of this consideration.

The objective is therefore not simply to make a system as restrictive as possible, but to achieve an appropriate balance where the system remains useful and accessible while maintaining an acceptable level of security.

Cybersecurity Guidance

We looked at the National Cyber Security Centre (NCSC) as an important source of cybersecurity guidance in the UK.

The NCSC provides public guidance for individuals, organisations and security professionals.

We also looked at NCSC guidance aimed at smaller organisations and its 10 Steps to Cyber Security.

Knowing where to obtain reliable security guidance is important because threats, vulnerabilities and recommended practices continually evolve.

Understanding Cyber Risk

We discussed cybersecurity risk and how it relates to threats, vulnerabilities and assets.

One model discussed was:

Risk = Threat × Vulnerability × Asset

Another way of expressing cyber risk is:

Cyber Risk = Impact × Probability

A vulnerability alone does not necessarily represent the same level of risk in every situation.

The importance of the affected asset, the likelihood of exploitation and the potential consequences all influence the overall level of risk.

Third-Party Risk

We discussed how organisations can inherit cybersecurity risk through third-party suppliers, services and software.

Even if an organisation protects its own systems effectively, vulnerabilities within a supplier or dependency can still create an attack path.

The British Airways Magecart incident was discussed as an example of how malicious JavaScript can be used to interfere with web pages and capture information entered by users.

This demonstrated why organisations need to consider supply-chain and third-party dependencies as part of their wider risk assessment.

Penetration Testing and Risk

I raised a question about what happens if an organisation experiences a breach shortly after completing a penetration test.

The discussion highlighted an important limitation of penetration testing.

A penetration test represents an assessment performed within a defined scope and timeframe. It cannot guarantee that every vulnerability will be discovered.

A malicious attacker may also have considerably more time to investigate a target than a penetration tester working within the constraints of a formal engagement.

My takeaway was that penetration testing is one component of an ongoing security programme rather than a one-time guarantee that an organisation cannot be compromised.

DDoS Mitigation

We discussed ways organisations can reduce the impact of Distributed Denial of Service attacks.

Examples included:

• Limiting the number of requests that individual sources can make.
• Filtering traffic to identify and block malicious or abnormal requests.
• Using load balancing to distribute legitimate traffic across multiple systems.
• Using specialist DDoS protection services capable of absorbing or filtering large volumes of traffic.

My understanding is that DDoS attacks are generally mitigated through multiple layers of protection rather than a single control.

The overall aim is to identify and filter malicious traffic, limit excessive requests and distribute legitimate workloads so that services remain available.

What I Learned

This session helped connect technical security concepts with the organisational controls that support them.

The CIA and DAD triads provide useful ways of thinking about what defenders are trying to protect and how those protections can be undermined.

I also developed a clearer understanding of the relationship between governance, policies, standards, procedures and guidelines.

The instructor’s Shodan demonstration, and using Shodan myself during the session, made the consequences of insecure configuration much more tangible. Seeing how publicly exposed devices and services can be discovered demonstrated why secure configuration and reducing unnecessary exposure are so important.

The discussion around risk also reinforced that cybersecurity is not simply about identifying vulnerabilities. Security professionals need to understand the likelihood of exploitation, the importance of the affected asset and the potential impact on the organisation.

Reflection

One of my main takeaways from this session was how interconnected different areas of cybersecurity are.

A technical vulnerability can exist, but whether it becomes a serious organisational risk depends on many other factors, including configuration, user behaviour, policies, training, exposure and the importance of the affected system.

The Shodan demonstration was particularly memorable because it showed how something as simple as exposing a device to the internet with an insecure configuration can create a significant security issue.

I was also interested in the discussion surrounding AI and cybersecurity. AI can potentially automate or support many technical security tasks, but cybersecurity also involves decisions around acceptable risk, ethics, organisational boundaries and responsibility.

The session reinforced the idea that effective cybersecurity depends on a combination of technology, people and processes rather than any single security product or control.

I continue these organisational themes in Session 3: Governance, Risk and Compliance.

Next Steps

I want to continue developing my understanding of:

• How organisations perform formal cyber risk assessments.
• How vulnerabilities are scored and prioritised using systems such as CVSS.
• How Shodan and similar tools can be used ethically during security reconnaissance.
• The NCSC 10 Steps to Cyber Security.
• How organisations defend against large-scale DDoS attacks.
• How security policies and standards such as ISO/IEC 27001 are implemented in real organisations.
• The changing role of cybersecurity professionals as AI capabilities continue to develop.