Cybersecurity Essentials

Week of 2026-09-29 · Download .docx

Objectives

Identify cyber threats — phishing, ransomware, DDoS, MitM, SQL injection — and describe the social engineering tactics attackers use.
Explain the three authentication factor categories and apply the principle of least privilege to access control decisions.
Differentiate virus, worm, Trojan, ransomware, rootkit, and adware by their behavior, delivery mechanism, and detection difficulty.
Describe defense-in-depth using firewalls, IDS/IPS, encryption, patch management, and the 3-2-1 backup rule.

Key terms

CIA Triad: The three security properties every system must protect: Confidentiality (only authorized access), Integrity (data not altered), Availability (accessible when needed).
Phishing: Social engineering attack via fraudulent email impersonating a trusted entity to steal credentials or install malware.
Ransomware: Malware that encrypts victim files using the attacker's public key and demands payment for the private key needed to decrypt.
Zero-Day: A vulnerability known to attackers but not yet disclosed to or patched by the vendor — no defensive countermeasure exists during the exposure window.
DDoS: Distributed Denial of Service — flooding a target with traffic from a botnet of thousands of compromised devices to exhaust capacity.
MitM: Man-in-the-Middle attack — attacker intercepts and potentially modifies communications between two parties who believe they communicate directly.
SQL Injection: Attack exploiting unsanitized input in web forms to inject malicious SQL code, potentially accessing or destroying database contents.
Authentication Factor: Evidence proving identity: something you know (password), something you have (token/phone), something you are (biometric).
Least Privilege: Security principle granting each user only the minimum permissions needed for their specific job duties — minimizes breach impact.
Worm: Self-replicating malware that spreads across networks autonomously without requiring a host file or user execution.
Rootkit: Malware that modifies OS internals to hide its own presence, processes, and files from monitoring tools — high stealth, difficult to detect.
Stateful Firewall: Firewall that tracks connection state — automatically allows return traffic for established sessions, blocks unsolicited inbound traffic.
3-2-1 Rule: Backup strategy: 3 copies of data, on 2 different media types, with 1 copy stored offsite.

The concept

Cybersecurity protects the Confidentiality, Integrity, and Availability (CIA Triad) of information and systems. Understanding how attackers operate and how defenses counter each threat is essential for every IT professional.

**How Attackers Think**

Attackers follow the path of least resistance. The most successful attacks are not technical masterpieces — they exploit human trust through social engineering. Phishing emails impersonate trusted organizations with urgent messages designed to bypass critical thinking. Spear phishing targets specific individuals using personal context harvested from social media. Business Email Compromise (BEC) impersonates executives to authorize fraudulent wire transfers.

Technical attacks exploit software vulnerabilities. SQL injection inserts malicious SQL code through unsanitized web form inputs, potentially returning all database records or deleting tables. Zero-day exploits leverage vulnerabilities vendors have not yet patched. DDoS attacks saturate a target's network or application resources using botnets of thousands of compromised devices, denying service to legitimate users.

**Authentication and Access Control**

MFA (Multi-Factor Authentication) requires proof from two or more distinct factor categories. Something you know (password, PIN) is the first factor — compromised by phishing and data breaches. Something you have (phone OTP, smart card, hardware token) adds a second category. Something you are (fingerprint, face scan) adds a third. Combining two categories means an attacker who steals your password still cannot log in without your phone.

The principle of least privilege limits each account's permissions to only what is strictly necessary. An attacker who compromises a limited account can only damage what that account can access. Applying least privilege reduces the blast radius of every attack, insider threat, and accidental misconfiguration.

**Malware Taxonomy**

Viruses attach to host executable files and spread when users run infected programs. Worms spread autonomously across networks by exploiting open ports and unpatched services. Trojans disguise themselves as legitimate software to trick users into voluntary installation. Ransomware encrypts files and demands payment. Rootkits use low-level OS hooks to hide themselves, infected processes, and network connections. Adware displays unwanted advertising and collects browsing data.

**Defense in Depth**

No single security control is sufficient. Defense in depth layers multiple controls: physical security → network perimeter (stateful firewall, IDS/IPS) → endpoint (host-based firewall, EDR, antivirus) → application (input validation, WAF) → data (encryption at rest and in transit) → people (security awareness training) → backup (3-2-1 rule). An attacker who defeats one layer faces another.

Worked examples

Example 1: Analyzing a phishing email: You receive an email from 'IT-Help@pgcc-portal.net' saying your password expires in 24 hours and you must click a link immediately. Red flags: (1) Domain is pgcc-portal.net — not pgcc.edu (legitimate PGCC domain). (2) Urgency creates pressure to act before thinking. (3) The link in the email goes to a different domain than the one shown when hovering. (4) The email requests credentials via a link rather than directing you to the official portal. Action: Do not click. Report to your IT department. Navigate directly to the official site.

Example 2: Applying the 3-2-1 backup rule: A small business has important client data on one computer. Current state: zero backups — a single ransomware attack destroys everything. Correct implementation: (1) Primary data on the local SSD (copy 1). (2) External hard drive backup kept in the office (copy 2, different media). (3) Cloud backup to a separate provider (copy 3, offsite). If ransomware encrypts the local data and the office external drive, the cloud backup is unaffected. The 3-2-1 rule survives fire, flood, theft, and most ransomware scenarios.

Common mistakes

Thinking antivirus alone provides sufficient protection. Antivirus detects known malware signatures. It cannot detect zero-day exploits, targeted spear phishing, or insider threats. Defense in depth requires multiple overlapping controls.
Calling two security questions 'two-factor authentication.' Both questions are 'something you know' — the same category. True MFA requires two different categories: knowledge + possession + biometrics. Two passwords are stronger than one but are not MFA.
Believing RAID 1 is a backup. RAID mirrors data in real time — if ransomware encrypts the primary drive, the mirror is also immediately encrypted. Backup requires an offline or geographically separate copy the ransomware cannot reach.
Underestimating phishing as 'too obvious to fall for.' Spear phishing uses personal context (your name, your manager's name, real project details) to create convincing messages. Security professionals with IT degrees fall for targeted phishing attacks regularly.
Assuming a rootkit can be removed with standard antivirus. Rootkits modify OS internals to hide themselves from normal scanning tools. Proper removal requires out-of-band scanning (booting from a known-good external drive) or OS reinstallation.

Self-check

Try each question before reading the answer. Answers at the bottom of this page.

1. Which malware type self-replicates across networks without requiring a host file?

Virus
Worm
Trojan
Adware

2. What does the 'Availability' property in the CIA Triad protect against?

Unauthorized data access
Data modification in transit
DoS attacks making services inaccessible
Password theft

3. Using a fingerprint AND a one-time code from your phone is an example of:

Single-factor authentication
Two-factor authentication
Password reuse
Brute-force resistance only

4. A zero-day vulnerability is:

A bug found on a product's launch day
A vulnerability known to attackers but not yet patched by the vendor
Any vulnerability older than 24 hours
A flaw only nation-states can exploit

5. The 3-2-1 backup rule requires:

3 daily backups on 2 external drives with 1 cloud copy
3 copies, 2 different media types, 1 offsite copy
3-month retention, 2-week incremental, 1 full backup
3 cloud providers, 2 TB minimum, 1 backup manager

Self-check answers

1. B — A worm spreads autonomously by exploiting network vulnerabilities — no host file or user execution required.
2. C — Availability ensures systems are accessible to authorized users when needed — DoS/DDoS attacks directly target this property.
3. B — Fingerprint (something you are) + OTP from phone (something you have) = two distinct factor categories = true 2FA.
4. B — Zero-day = zero days the vendor has had to develop a patch. The vendor is unaware or has not yet released a fix.
5. B — 3 total copies, on 2 different types of media, with 1 stored offsite — protects against drive failure, site disasters, and ransomware.

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top