Talib AliCybersecurity Study Guide & Portfolio

Study Guide

People, Processes & Technology

What cybersecurity protects, and why trained people, repeatable processes and supporting technology have to work together.

Lesson 1.1 Cybersecurity Foundations

This first lesson assumes no prior knowledge. It answers two questions that the rest of the Study Guide builds on: what does it take to keep an organisation secure, and what exactly does cybersecurity protect?

It is tempting to think that keeping an organisation safe is a matter of buying the right product. This lesson puts that idea to the test, and gives you a simple way to work out what is missing when something goes wrong.

Think

Is the best alarm enough?

Start with something every school has, long before computers come into it.

Think it through

A school installs the best fire alarm available. One afternoon a fire starts in a science lab. What else has to be true for everyone in the building to get out safely?

Show what happens

The alarm is only the start. Most answers fall into three groups:

  • Who has to act. Everyone must recognise the sound, know what to do, stay calm and help others. Somebody has to know it is their job to call the fire service.
  • What routine they follow. The routes out, the assembly point, a register to check that everyone is there, and practice drills so that it happens without thinking. All of this has to exist before the fire starts.
  • What equipment must work. The alarm itself, tested regularly, along with doors that open and signs that can be seen.

Take any one of these away and the plan fails. A perfect alarm does not help pupils who do not know where to go, and a well-rehearsed evacuation does not help if nobody hears the alarm.

Keep your three groups in mind: who has to act, what routine they follow and what equipment must work. Protecting computers and information depends on the same three things, and the next step gives them the names used in security.

Explain

The idea

Think it through

The three elements of cybersecurity are People, Processes and Technology. Think back to your three fire-alarm groups: who has to act, what routine they follow and what equipment must work. Which element matches each group? How would the three elements work together in an office that depends on computers?

Show what happens

Who has to act matches people, what routine they follow matches processes, and what equipment must work matches technology.

In an office the three work together. When a new teacher joins a school, for example, a member of staff (people) follows an agreed checklist (a process) to set up an account in the school’s computer system (technology). The diagram below shows where they overlap.

Security is not just about software and tools. It depends on three connected elements:

  • People: awareness, skills, responsibilities and the confidence to report problems.
  • Processes: repeatable ways to manage access, changes, incidents and recovery.
  • Technology: controls that support safe, reliable operation.

Together they are often called people, processes and technology. Protecting information by bringing policies, processes and technical controls together, throughout the time the information is kept and used, is called information security. It covers information in every form, paper included; cybersecurity is the part that deals with computers, networks and the data they hold, and the two overlap so much that the words are often used interchangeably.

People, processes and technology work best where they overlap

Three overlapping circles, with a fictional example: a new teacher joining a school and being given a computer account.

Three overlapping circles labelled People, Processes and Technology. Numbered areas 1 to 4 mark where they overlap; the list explains each area.PeopleProcessesTechnology1234
People
Notice problems, make judgements and report concerns. The office manager checks what the new teacher actually needs.
Processes
Agreed steps, with an owner and a timescale, followed the same way every time. A checklist for every new member of staff.
Technology
Tools and technical controls that enforce rules and support people. The account system that gives the teacher access.
People and Processes
People who know the agreed steps and that the job is theirs: the manager follows the checklist and signs it off.
Processes and Technology
Tools that build the steps in: the account system will not create the account until the checklist has been signed off.
People and Technology
Tools that people understand and can use safely: the new teacher is shown how to sign in, and what the school will never ask for.
All three
They reinforce one another: the teacher has the access they need on the first day, and no more, and every step can be checked later.

The circles are not separate boxes. Setting up one account involves all three, and a weakness in one is often caught, or made worse, by the others.

The reason all three elements are needed is simple: technical standards and controls can only achieve so much if people are not properly trained. The reverse is also true. Well-trained people still need a clear process to follow and tools that make the right action practical. None of the three can be relied on alone, and much of the real work happens where they meet.

A fire does not try to avoid the alarm. An attacker does: they look for the gap between the tools, the people and the routines, and they change their approach when one is closed. That is one reason why security has to be reviewed and practised regularly, not set up once.

Discover

How they connect

Use the three elements to work out what went wrong in this fictional company.

The company has trained its staff to spot suspicious emails, and its email program has a Report button that sends a copy of a message to a shared mailbox. One Monday, a fake email asking staff to “confirm your password” reaches sixty people. Twelve of them press Report within the hour. On Friday, the company discovers that four other people typed their passwords into the fake page on Monday, and that attackers have been reading those four people’s email all week. The shared mailbox still holds all twelve reports, unopened.

Think it through

What was the main thing that went wrong?
Show the answer

Answer: C. The follow-up, because nobody was responsible for reading reports.

Each option can be tested against the evidence:

  • The training worked for the twelve people who recognised the email and reported it. It did not stop everyone, but no training does.
  • The Report button did what it is for: it delivered every report. Stopping the email arriving is a different job, done by a filter.
  • The follow-up is where the chain broke. Nobody had been given the job of reading the shared mailbox, or a time by which to do it, so four days passed. That missing piece is a process. A look at the mailbox on Monday could have warned the four people, had their passwords changed and removed the email from everyone’s inbox.

That does not make the other two perfect. Better training might have saved one or two of the four, and a stronger filter might have blocked the email altogether. Real incidents often have more than one weakness, but the evidence here points to one main failure: twelve warnings that nobody read.

A reporting tool is useful only if people know when to use it and a process ensures reports are acted on. Likewise, a policy needs workable controls and clear responsibilities to become everyday practice. The example below shows a similar email with all three elements working.

  1. Technology: the organisation’s email service filters some malicious messages and gives staff a button to report suspicious ones. Filtering does not catch everything.
  2. People: a member of staff receives a message asking them to confirm their password through a link. Awareness training helps them recognise the warning signs, so they report it instead of clicking.
  3. Process: a documented procedure says who reviews reports, how quickly, and what to check next, such as whether anyone else received the same message.
  4. Follow-through: the reviewer finds that several colleagues received it, removes the message from their mailboxes and checks whether anyone entered their password.
  5. Remove one element and see what breaks: without the button, reporting is slow and inconsistent; without training, the message is not recognised; without the procedure, the report may sit unread.

The outcome depended on all three elements working together, not on any single one.

Check your understanding

A new email filter is installed, but staff were never told what it does. They assume it catches every bad email, and stop checking links before they click. Which element was most directly neglected?
Show the answer

Answer: C. People: nobody told staff what the filter can and cannot do.

The filter behaved as filters do. The gap was in people: nobody explained its limits, so staff stopped doing the checking that only they could do.

Think

Tracing a fraud back

Here is a fictional incident to trace back to its causes.

The finance officer at a primary school receives an email that appears to come from the school’s usual building contractor. It says the contractor’s bank details have changed and asks for the next payment to go to a new account. The sender’s address differs from the contractor’s real one by a single letter, and the school’s email program shows no warning that the message came from outside the school. The finance officer has never had any training on this kind of fraud, and the school has no rule about how a change of bank details must be confirmed. The next payment, £18,000, goes to the criminals.

Think it through

List every weakness you can find that helped the fraud succeed, and say which element each one belongs to.

Show what happens

There are weaknesses in all three elements:

  • People: the finance officer had never been taught that a sudden change of bank details is a classic sign of fraud.
  • Process: no rule said that a change of bank details must be confirmed, for example by telephoning the contractor on a number the school already holds.
  • Technology: the email program gave no warning about an outside sender whose address imitated a known one.

Any one of these, put right, might have stopped the payment.

Real incidents are usually like this: several smaller weaknesses line up, rather than one thing breaking. That is useful as well as worrying, because it means there are several places to make a repair. A careful response fixes more than one. Here the telephone check is probably the strongest single fix, because it still works when an email looks perfect, but training and a warning on outside senders make the fraud harder to begin with.

The elements also overlap. The finance officer’s missing training is a people weakness, but making sure that staff are trained is somebody’s job, which is a process. Look back at the new email filter in the last step: staff lacked knowledge (people), and nobody had been given the task of telling them (process). The three elements are a way of searching for causes, not boxes into which every failure must fit exactly once.

Many everyday IT support requests involve all three elements. A password reset, for example, depends on a person verifying the caller’s identity, a procedure defining how that check is done, and a tool that performs the reset. When something goes wrong, look for weaknesses in each element, rather than assuming a new tool is the answer.

Predict

What cybersecurity protects

So far the lesson has asked what it takes to keep an organisation secure. The other half of the question is what, exactly, is being protected. It is easy to picture cybersecurity as protecting computers. The picture is wider.

Think it through

You can see a pupil’s record on the computer on your desk at school. Does that mean the record is stored on that computer?
Show the answer

Answer: B. No: it is usually kept on a school server, and a copy is shown.

Usually not. The record is kept on a server: a computer whose job is to provide something, such as files or records, to other computers, rather than being used by one person at a desk. The desk computer asks for the record and shows a copy. So the request passes through several parts on its way, and every one of them has to work, and be trustworthy, for the record to be safe.

Here are the parts, in the order the request meets them:

  • The teacher: the person asking. Their account and password tell the system who they are.
  • The workstation: the computer on the desk, used by one person at a time.
  • The application, or program: the records app the teacher uses. On the server, a matching records service answers its requests.
  • The operating system: the software that runs a computer and lets applications use it. Windows, macOS and Linux are operating systems. The workstation and the server each have their own.
  • The network: the cables, Wi-Fi and connecting equipment that carry the request between the two computers. Module 3 explains that equipment from the beginning; for now, it is whatever joins the devices together.
  • The server, and the data stored on it: here, the pupil records themselves.
Opening a pupil’s record: what has to work

A teacher at a workstation on their desk opens a record held on the school server (fictional). Inside each computer, the application runs on the operating system, which runs on the hardware. The network joins the two computers, and the record stays on the server.

Teacher signs in and asks for a record

Teacher’s workstation

  1. Records app asks for the record and shows a copy
  2. Operating system for example Windows; runs the app
  3. Hardware the computer itself: screen, keyboard and processor

School network cables, Wi-Fi and connecting equipment carry the request and the reply

School server

  1. Records service checks who is asking, then finds the record
  2. Operating system for example Linux; runs the service
  3. Hardware and disks the server computer and its storage
  4. Pupil records the stored data, kept on the server’s disks and normally read through the records service

Follow the request

  1. The teacher asks the records app on the teacher’s workstation for a pupil’s record.
  2. The app passes the request to the workstation’s operating system, which sends it across the school network to the server.
  3. On the server, the records service checks that this teacher is allowed to see the record, then reads it from the server’s disks.
  4. A copy travels back across the network and the app displays it. The record itself stays on the server.

A real school has more parts, such as many servers and the equipment that joins the network together. The diagram shows only what this one request needs.

Every part on that path has to work, and has to be trustworthy, for the record to be both available and safe. That is why cybersecurity protects much more than “the computer”: the data, the applications and services, the operating systems, the devices, the networks between them and the people who use them. The same connections matter from an attacker’s side: a weakness in any part the request passes through, or one stolen account, can be the first step towards the records.

Check your understanding

The records program at a school is well protected: only staff with the right password can open records in it. An attacker cannot get into the program, but takes control of the server it runs on. Are the records still safe?
Show the answer

Answer: B. No: whoever controls the server can reach what is stored on it.

The password protects the records service. Control of the server itself, its operating system and its disks, can bypass that protection, because the service and the records are both on the server. That is why the server needs protecting as well as the program.

Predict

Two computers in a bakery

Most of the computers so far have handled information. Here is a fictional business where one of them does something else.

A bakery has two computers that need the same security update. Installing it means restarting each computer, which takes about ten minutes.

  • The office computer stores orders and invoices. The office is staffed from 9 a.m. to 5 p.m.
  • The oven computer sets the oven temperatures and runs the conveyor that carries loaves through the ovens. While it restarts, it can do neither. The ovens bake day and night from early on Monday until Saturday afternoon, and are switched off and cleaned at the weekend.

The update arrives on a Tuesday morning.

Think it through

Which plan for the two restarts makes the most sense?
Show the answer

Answer: A. Office computer on Tuesday evening; oven computer at the weekend.

The update is the same for both computers; what happens during the ten minutes is not. A paused office computer means a short wait for orders. A paused oven computer means loaves in hot ovens with nothing controlling the temperature or the conveyor, so its restart has to wait until the line has stopped.

Information systems and operational technology

The bakery’s two computers show a distinction that is about what a computer system is for.

  • Information technology (IT) handles information: email, documents, records, websites. If it stops, people cannot get to information.
  • Operational technology (OT) controls physical things: pumps, valves, production lines, signals, lifts. If it stops or misbehaves, something happens in the physical world. The systems that do this monitoring and controlling are called Industrial Automation and Control Systems (IACS). They are found in transport, manufacturing, utilities and other critical infrastructure.

A shorter name you will often meet is industrial control systems (ICS): the computers and related equipment used to monitor or control physical processes, such as the machinery in a factory or the pumps at a water works. A later lesson, Attack Surfaces and Attack Vectors, explores how attackers might target these systems and where they meet a business’s ordinary IT. If you are studying for Security+, ICS is the term its exam objectives use.

Think it through

The oven computer has to wait until Saturday. Using people, processes and technology, what should the bakery put in place for the restart itself, and to protect the oven computer until then?

Show what happens

A good plan uses all three elements, because the risk is physical: the people who run the line, an agreed and safe order of work, and other protections to cover the days of waiting. The worked example below sets it out step by step, next to the same decision in a school office.

A security update is released. Installing it needs a restart. Two technicians face what looks like the same decision.

In a school office (IT).

  1. The update is for the server that stores staff documents.
  2. While it restarts, nobody can open their files for about ten minutes.
  3. The technician schedules it for 6 p.m., when the office is empty, and tells staff beforehand.
  4. Result: a short, planned interruption to information. Nothing physical is affected.

In the bakery’s factory (OT).

  1. The update is for the computer that controls the ovens and the conveyor carrying loaves through them.
  2. While it restarts, nothing is controlling the oven temperature or the conveyor. The line runs from Monday to Saturday without a break, and stopping it mid-batch means burnt bread, a jammed conveyor and hot machinery with nobody in control.
  3. People: the engineer plans the restart with the supervisors who run the line, and everyone on the line knows when it will stop.
  4. Process: they agree a safe order of work: finish the batch, empty and stop the line, restart, check that the computer is controlling the ovens correctly before baking resumes, and record what was done.
  5. Technology: until Saturday, other protections cover the gap. The oven computer is kept cut off from email and the internet, so the weakness the update fixes is harder to reach.
  6. Result: the same update waits four days for a planned stop. In plants that never stop, an update can wait weeks for a planned shutdown.

Why the answers differ: the question in the office is “how long can people manage without their files?”. The question in the factory is “what happens to the ovens, the product and the people nearby while the controller is off?”. The technology is similar; the consequences are not.

The distinction matters because a security decision in an OT environment may affect physical operations and safety, not only information.

Where this simplifies. Real factories rarely depend on a single computer. Ovens and other machines usually have their own controllers and safety cut-outs, which keep working if a supervising computer restarts, and not every update needs a restart. What varies from plant to plant is how much a restart, or a faulty update, could disturb, which is why the people who run the equipment are part of the decision.

Apply

Apply it in a new situation

These questions use the three elements in situations the lesson has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.

Apply it

A fictional charity’s files are copied to a backup drive automatically every night. The volunteer who set this up left last year. When an attack scrambles the charity’s files, it turns out that the drive has been full since March, and its warning emails have been going to the volunteer’s old address. What most needs to change?
Show the answer

Answer: B. A named person who regularly checks that backups work.

The drive worked as set up, and even warned that it was full. The weakness was a process: nobody owned the backups after the volunteer left, so the warnings went nowhere. A named owner, a regular test that files can actually be restored, and a handover whenever someone leaves would each have caught it. A bigger drive would only delay the same failure.

Apply it

At a fictional dental practice, a receptionist starts typing “Sam” to email the day’s patient list to the practice manager. The email program suggests a different Sam, a patient, and the list goes to them. The practice has no rule about emailing patient lists, and its staff have had no training on handling them. Which statement is most accurate?
Show the answer

Answer: C. Each element played a part, so the fix should cover more than one.

The slip was human, but the practice made it likely. No rule said how patient lists should be shared (process), nobody had been trained to check a recipient before sending personal details (people), and the email program offered a patient’s address with no warning (technology). Fixing only one leaves the others. A sensible response might combine a rule that patient lists stay in the practice’s own system rather than going by email, short training, and a warning whenever an email with an attachment is addressed outside the practice.

Check

Check your understanding

These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow.

  1. A fictional firm buys an advanced email-filtering product but gives staff no training and sets no procedure for handling reported messages. Suspicious emails that get through are rarely reported, and the few reports that are made go unread. Which explanation best accounts for what has gone wrong?

    Show answer

    Answer: Technical controls achieve little without trained people; security depends on people, processes and technology together.

    Information security brings together policies, processes and technical controls, and technical controls can only achieve so much if people are not properly trained. Here the filter works, but untrained staff do not recognise and report what it misses, and with no process the reports that are made are never acted on. Changing only the product, or only blaming staff, leaves the other gaps in place.

    Revision sources: Session 2: Cyber Fundamentals Part 2 (Classroom session record)

  2. A fictional water company’s IT team plans to install an urgent update by restarting systems during working hours, as it does for office servers. One of the systems controls pumps at a treatment works. Why does the difference between IT and OT matter here?

    Show answer

    Answer: OT and IACS systems monitor or control physical processes, so restarting one can affect physical operations and safety, not only information.

    IT supports information and business systems, while Industrial Automation and Control Systems (IACS) and operational technology (OT) monitor or control physical processes. Security decisions there can therefore affect physical operations and safety. That does not mean OT is never updated; it means a routine office approach to restarting systems cannot simply be copied onto equipment that controls pumps.

    Revision sources: Session 4: Governance, Risk and Compliance — In Depth (Classroom session record)

For more practice, use the Security Principles & Controls topic. Two questions cover why people, processes and technology are needed together and why the IT and OT distinction matters, and a flashcard recalls what cybersecurity protects. They are learning-only.

Consolidate

What to remember

  • People, processes and technology work together: each covers gaps the others would leave, and much of security happens where they overlap.
  • Real incidents usually involve weaknesses in more than one element. Look for all of them before choosing a fix, rather than reaching for a new tool.
  • Cybersecurity protects more than computers: the data, the applications and services, the operating systems, the devices, the networks that join them and the people who use them. All of them have to work for information to stay safe.
  • Operational technology controls physical things, so a security decision there can affect safety, not only information.

Key terms

Information security

Protecting information by bringing together policies, processes and technical controls throughout the information’s lifecycle.

Glossary entry

People, processes and technology

The idea that effective security depends on trained, responsible people, repeatable processes and supporting technical controls working together.

Glossary entry

OT (Operational Technology)

Systems that monitor or control physical equipment and processes, such as in manufacturing, transport or utilities.

Glossary entry

IACS (Industrial Automation and Control Systems)

Industrial systems that monitor or control physical processes; they are associated with operational technology environments.

Glossary entry

Key takeaway

The three elements should reinforce each other. Focusing only on technology leaves gaps in how security is understood and carried out.

Next, the CIA Triad describes the three outcomes that people, processes and technology work together to protect.

Common misunderstandings

It protects devices, networks, operating systems, applications, services and data. In OT environments, it can also protect physical operations and safety.

Technical controls can only achieve so much without trained people. A tool also needs a process that makes sure someone acts on what it finds.

Most incidents combine weaknesses in more than one element, and the elements overlap: missing training is a people weakness, and making sure training happens is a process. Look for every weakness, not just the first one you find.

People are also how many problems are noticed and reported. Controls work best when they are usable and supported by clear processes; Security, Usability & Functionality develops this.

Further reading

NCSC secure design principles considers the system and how it is used.

Lesson sources and acknowledgements

Where this lesson comes from

  • The approved Session 2 Learning Log records that information security brings together policies, processes and technical controls, and that technical controls can only achieve so much if people are not properly trained. Session 2 linked this to ideas introduced in Session 1.
  • The Study Buddy session on 9 September explored what an organisation’s network contains. It was a supplementary session, not a numbered classroom session.
  • Session 4 introduced industrial control systems and operational technology.

The diagrams, worked examples and misunderstandings in this lesson are supplementary explanations built on those sources. The school office, the organisation in the reporting example and the bakery are fictional; none is a real incident or work I carried out.

This guided version (approved by the site owner, published 1 November 2026) adds supplementary material written for the Study Guide: the fire-alarm opening and its limits, the overlap diagram and the new teacher in it, the unread reports, the school invoice fraud, the pupil record and its system diagram, the bakery’s two computers, the charity’s backups, the dental practice, the overlap between the elements, the note on where the bakery simplifies, every question asked in the lesson with its feedback and hints, and the closing summary. All of these settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.

Taught in classroom sessions

From Study Buddy sessions

Related lessons

Terms in this lesson

Practise this lesson

Quiz these topicsFlashcards