Foundations of Cybersecurity: Core Concepts and Standard Terminology

When you check your bank balance on your smartphone, upload a family photo to a cloud storage service, or log into your company’s internal work system, you are interacting with digital information assets that require protection. In 2023 alone, more than 2,000 organizations worldwide were affected by the MOVEit file transfer vulnerability, including the UK’s National Health Service (NHS), the U.S. Department of Energy, and payroll providers serving millions of employees. Attackers exploited a flaw in the MOVEit software to steal sensitive data such as social security numbers, bank account details, and employee records, with estimated total losses exceeding $10 billion. This incident is not an outlier: according to IBM’s 2023 Cost of a Data Breach Report, the global average cost of a single data breach reached $4.45 million, while the average cost in the United States hit a record $10.12 million. These numbers underscore a core truth of the digital age: information security is no longer a niche technical concern for IT departments, but a fundamental requirement for every individual, organization, and even national infrastructure.

All cybersecurity practices, from enterprise-level security architecture to personal device protection, are built around three core objectives first formalized by the U.S. National Security Agency in the 1970s: the CIA Triad, which stands for Confidentiality, Integrity, and Availability. These three properties form the universal evaluation standard for information security, and any security measure, whether it is encryption, access control, or backup, is designed to protect one or more of these attributes. To understand the entire cybersecurity field, we must first clarify the definition, extension, and balance mechanism of each attribute of the CIA Triad.

1.1 The CIA Triad: The Cornerstone of Information Security

The CIA Triad is not just a theoretical framework, but a practical guide that runs through every link of information system design, operation, and maintenance. For ordinary users, the information assets protected by the CIA Triad include chat records, photo albums, and bank account passwords on mobile phones; for enterprises, it includes customer data, trade secrets, and internal operation systems; for the government, it includes population information, infrastructure control systems, and national security data. The three attributes of the CIA Triad are interdependent and mutually restrictive, and only by balancing the three can truly effective information security be achieved.

1.1.1 Confidentiality: Ensuring Information is Only Accessible to Authorized Subjects

Confidentiality refers to the property that information is not disclosed to unauthorized individuals, entities, or processes, and is only accessible to users with explicit access rights. In daily life, the most common example of confidentiality protection is end-to-end encrypted chat tools such as Signal and WhatsApp: even if the message is intercepted during transmission, the interceptor can only see a string of garbled code without the decryption key, and cannot read the actual content of the message.

The implementation of confidentiality relies on two core technical means: access control and encryption. Access control is the most basic means of confidentiality protection, which restricts access to information resources through identity authentication and permission management. For example, when you log into a corporate email system, you need to enter a username and password for identity authentication, and even after logging in, you can only access emails and files within your permission scope, and cannot view the emails of other departments. Multi-factor authentication (MFA), which is widely promoted at present, is an upgraded version of access control: it requires users to provide two or more independent authentication factors when logging in, such as "password + SMS verification code" or "password + fingerprint", which reduces the risk of password leakage and unauthorized access by more than 99%.

Encryption is the core technical means of confidentiality protection for data storage and transmission. It is divided into symmetric encryption and asymmetric encryption. Symmetric encryption uses the same key for encryption and decryption, which has the advantages of fast speed and high efficiency, and is suitable for encrypting large amounts of data. The Advanced Encryption Standard (AES), which is currently the global mainstream symmetric encryption algorithm, is used by governments and enterprises around the world to protect classified data. Asymmetric encryption uses a pair of keys: a public key for encryption and a private key for decryption. The public key can be disclosed to the public, but the private key is only held by the owner. This mechanism is widely used in digital signatures and secure communication. For ordinary users, the most common scenario of asymmetric encryption is the HTTPS protocol used when browsing websites: the browser uses the website’s public key to encrypt the request, and only the website’s server can decrypt it with the private key, preventing data from being stolen during transmission.

Confidentiality breaches are one of the most common types of security incidents. In 2021, LinkedIn, the world’s largest professional social platform, suffered a massive data breach, and the personal information of more than 700 million users, including names, phone numbers, email addresses, and geolocation information, was sold on the dark web for as little as $5,000. This incident directly violated the confidentiality of user information: attackers obtained unauthorized access to user data through vulnerabilities in LinkedIn’s API, and disclosed it to third parties, causing widespread privacy infringement and phishing fraud.

1.1.2 Integrity: Ensuring Information is Not Tampered With Without Authorization

Integrity refers to the property that information is not tampered with, destroyed, or inserted with fake content without authorization during storage, transmission, or processing. For ordinary users, the most intuitive example of integrity protection is the hash value displayed when downloading software: the official website will publish the SHA-256 hash value of the software installation package. After downloading, users can calculate the hash value of the local file by themselves. If the calculated value is inconsistent with the official published value, it means the file has been tampered with during transmission, and may contain malware.

The implementation of integrity relies on two core technical means: hash functions and digital signatures. A hash function is an algorithm that maps data of any length to a fixed-length string of characters (called a hash value or digest). Even if only one byte of the original data is modified, the generated hash value will be completely different. Common hash algorithms include MD5, SHA-1, and SHA-256. It should be noted that MD5 and SHA-1 have been proved to have collision vulnerabilities, so they are no longer recommended for security scenarios, and SHA-256 or higher algorithms should be used. A digital signature is a technology that combines asymmetric encryption and hash functions: the sender uses its own private key to encrypt the hash value of the file to generate a signature, and the receiver uses the sender’s public key to decrypt the signature to obtain the hash value, and then compares it with the hash value calculated locally. If the two are consistent, it means the file has not been tampered with and is indeed sent by the sender.

Integrity breaches often have more serious consequences than confidentiality breaches. The 2020 SolarWinds supply chain attack is a classic case of integrity destruction. SolarWinds is a well-known U.S. IT management software company, and its Orion software is widely used by government agencies and large enterprises around the world for network