Cybersecurity Beginner Course

Cybersecurity protects systems, networks, and data from digital attacks. Its foundation is the CIA triad: Confidentiality (only authorized people can read data), Integrity (data cannot be altered without detection), and Availability (systems stay up when needed). Every security control you will ever learn — firewalls, encryption, access policies, backups — maps back to one of these three goals. Understand the triad and you understand the 'why' behind every defensive decision.

Confidentiality — encryption hides data from unauthorized readers.

These three words are not synonyms. A vulnerability is a weakness — a bug or a misconfiguration. A threat is something that can exploit that weakness — a hacker, malware, or a flood. Risk is the chance that a threat exploits a vulnerability and causes damage, usually scored as likelihood multiplied by impact. Security teams cannot eliminate all risk; they manage it by patching vulnerabilities, blocking threats, or lowering the impact of a breach. Reducing any one factor reduces the total risk.

A vulnerability is a weakness; a threat is the danger that exploits it.

Malware is malicious software. A virus attaches to a file and spreads when that file runs. A worm self-replicates across networks without user action. A trojan disguises itself as legitimate software. Then there is ransomware (encrypts your files for money), spyware (steals data), and rootkits (hide deep in the system). Detection combines antivirus signatures, behavior analysis, and good patch hygiene — because malware usually enters through unpatched software or human error. A few basic commands let you spot suspicious processes and network connections.

# Check running processes for suspicious names (Linux)
ps aux | grep -i -E 'miner|backdoor|crypt'
# Check listening ports
netstat -tulnp
# Scan a file for malware (ClamAV)
clamscan /home/user/Downloads/suspicious.exe

A worm — it self-replicates over the network.

Phishing tricks people into revealing credentials or installing malware by impersonating trusted senders. Social engineering is the broader art of manipulating humans — pretexting, baiting, scareware, even in-person tailgating. Email red flags: urgent language, mismatched sender domains, unexpected attachments, and links whose real destination does not match their visible text. The strongest technical controls still fail when a user is deceived, which is why humans are called the weakest link — and the most important defense. Hover over every link and read the actual domain before clicking.

Urgency — attackers create false time pressure to stop you from thinking.

Authentication proves who you are. Passwords remain common but are weak when reused or simple. Modern systems never store plaintext passwords — they store a salted hash, so a database leak does not reveal the actual secret. Strong practices: use a password manager, long passphrases, and a unique password per site. A credential breach on one site becomes a breach everywhere if you reuse passwords, because attackers try stolen credentials on every other service. The hashing example below shows the concept in a few lines of Python.

import hashlib

def hash_password(pw, salt='s0m3s@lt'):
    return hashlib.sha256((salt + pw).encode()).hexdigest()

print(hash_password('correct horse battery staple'))
# NEVER store plaintext; always hash with a unique salt

Hashing protects real passwords if the database is stolen.

MFA requires two or more independent proofs: something you know (password), something you have (phone or security key), or something you are (fingerprint or face). Even if an attacker steals your password, they cannot log in without the second factor. Time-based one-time passwords (TOTP) and hardware keys are the strongest forms. Enabling MFA on your email is the single highest-impact security step you can take today, because email is the master key that resets passwords everywhere else.

Something you know, something you have, something you are.

Encryption turns readable plaintext into ciphertext using a key. Symmetric encryption uses ONE shared key — fast, and used by AES and ChaCha20. Asymmetric encryption uses a public/private key pair — slower, used by RSA and ECC; anyone can encrypt with the public key, but only the private key can decrypt. Real systems combine both: asymmetric keys securely exchange a symmetric session key, then fast symmetric encryption protects the actual data. This hybrid is how HTTPS, VPNs, and messaging apps work.

# Symmetric: encrypt a file with AES-256
openssl enc -aes-256-cbc -salt -in secret.txt -out secret.enc
# Asymmetric: generate an RSA keypair
openssl genpkey -algorithm RSA -out private.pem
openssl rsa -pubout -in private.pem -out public.pem

Symmetric uses one shared key; asymmetric uses a public/private keypair.

Every open port is a door, and every service behind it is a potential entry point. Attackers scan networks to find open doors — SSH on 22, web on 80 and 443, databases on 3306. Defense-in-depth layers controls so one failure does not compromise everything: firewall, network segmentation, patching, monitoring, and least-privilege access. The golden rule is simple: close what you do not need, and require authentication on everything that must stay open.

# Discover open ports on a host (Nmap)
nmap -sV 192.168.1.10
# Show your own listening services
ss -tulpn
# Test reachability of a port
nc -zv 192.168.1.10 22

Each open port exposes a service that could have exploitable vulnerabilities.

A firewall filters traffic based on rules — allow or block by IP, port, and protocol. Host-based firewalls (UFW on Linux, Windows Defender Firewall) protect a single machine; network firewalls protect entire segments. The principle of least privilege applies to rules: deny everything by default, then allow only what is necessary. A misconfigured firewall that blocks legitimate traffic is annoying, but an open firewall that allows everything is a breach waiting to happen.

# Enable UFW and set sane defaults (Ubuntu)
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp    # SSH only
sudo ufw allow 443/tcp   # HTTPS
sudo ufw enable
sudo ufw status verbose

Block everything by default, then explicitly allow only required traffic.

Traditional antivirus matches files against known signatures — effective for known malware but blind to new threats. EDR (Endpoint Detection and Response) goes further: it continuously monitors behavior, detects anomalies, and lets responders investigate and isolate infected machines. Modern security favors behavior-based detection plus threat intelligence feeds. For a home Linux system, ClamAV provides free on-demand scanning; enterprise Windows and macOS use Defender or commercial EDR.

# Update virus definitions and scan a directory
sudo freshclam
clamscan -r /home/user/Downloads

# Check running services for anomalies
systemctl list-units --type=service --state=running

EDR detects novel or unknown malware by behavior, not just known signatures.

Most breaches exploit known vulnerabilities that already have patches — attackers simply scan for systems that have not updated. The WannaCry ransomware spread through a flaw that had a patch available months earlier. Patching is unglamorous but it is the highest-return security activity. Enable automatic security updates, prioritize internet-facing services, and patch within days, not months. Every day a critical patch is unapplied is a day attackers can walk through an open door.

# Update Debian/Ubuntu packages
sudo apt update
sudo apt upgrade -y
# Enable automatic security updates
sudo dpkg-reconfigure --priority=low unattended-upgrades

Because many systems never apply available patches, leaving known doors open.

Web applications are a prime target. The OWASP Top 10 lists the most critical web risks, led by broken access control, cryptographic failures, injection, and insecure design. SQL injection lets attackers manipulate database queries; cross-site scripting (XSS) runs attacker JavaScript in victims' browsers. Defenses include parameterized queries, input validation, output encoding, and strong access controls. Understanding this list is the fastest way to build secure web apps.

# Vulnerable query (NEVER do this)
# query = f"SELECT * FROM users WHERE id = {user_input}"
# Safe parameterized query (Python + psycopg2)
cur.execute('SELECT * FROM users WHERE id = %s', (user_input,))

# Encode output to prevent XSS
from markupsafe import escape
safe = escape(user_supplied_text)

SQL injection.

Wireless networks broadcast traffic through the air, so encryption is essential. WPA2-PSK is common but vulnerable to offline password cracking; WPA3 fixes key weaknesses with stronger handshakes. To secure a home network: use WPA2/WPA3 with a long passphrase, change default router credentials, disable WPS, and keep router firmware updated. Be wary of public Wi-Fi — anyone on the same network can attempt to intercept traffic, so use a VPN or avoid sensitive logins on open networks.

# Check Wi-Fi security (Linux, requires nmcli)
nmcli -f SSID,SECURITY dev wifi list

# Disable WPS on your router admin page
# Use WPA3 if available, else WPA2 with a long passphrase

WPA3 fixes WPA2 flaws that allowed offline password cracking of the handshake.

Backups are your last defense against ransomware, disk failure, and accidental deletion. The 3-2-1 rule: keep 3 copies of your data, on 2 different media types, with 1 copy offsite. Regular automatic backups, versioning, and — critically — tested restores are what separate a real plan from a wish. A backup you have never restored is not a backup. Ransomware specifically targets backups, so keep at least one copy offline or immutable.

# Full backup with rsync
rsync -av --delete /home/user/data/ /mnt/backup/data/
# Offsite push to remote server
rsync -av /mnt/backup/ user@remote:/backups/
# Verify by restoring a single file
rsync -av /mnt/backup/data/report.pdf /tmp/restore-test/

3 copies, 2 different media types, 1 offsite copy.

Physical security is often ignored but it is the foundation — if an attacker has physical access, most digital controls fall. Threats include tailgating through locked doors, shoulder surfing passwords, USB drop attacks (leaving malware-loaded drives), and device theft. Mitigations: lock screens, full-disk encryption, cable locks, privacy screens, and a clean-desk policy. Remember the rule: physical access equals game over unless the disk is encrypted.

# Enable full-disk encryption (Linux LUKS)
sudo cryptsetup luksFormat /dev/sdb1
sudo cryptsetup open /dev/sdb1 backupdisk
# Set a short screen-lock timeout
gsettings set org.gnome.desktop.session idle-delay 300

It makes the stolen disk unreadable without the passphrase.

Security policies document what is allowed and what is required. An Acceptable Use Policy defines proper use of company systems; a password policy sets complexity and rotation rules; an incident response policy says who does what during a breach. Policies fail when they are vague, unenforced, or unknown to employees. Good policies are clear, realistic, and paired with training — because security is as much a people and process problem as a technical one.

They are vague, unenforced, or unknown to the people who must follow them.

Incident response is the plan for when (not if) something goes wrong. The lifecycle: Preparation, Detection and Analysis, Containment, Eradication, Recovery, and Post-Incident Activity. Speed matters — mean time to detect (MTTD) and mean time to respond (MTTR) are key metrics. A written playbook with assigned roles beats improvisation during a crisis. After any incident, a blameless post-mortem turns mistakes into stronger controls.

Isolate it from the network (containment) while preserving evidence.

Hackers are classified by intent. White hats (ethical hackers) test systems with permission to find and fix flaws. Black hats attack without authorization for personal gain. Gray hats operate in between, sometimes finding flaws and disclosing them without asking. Penetration testing is the authorized, structured process of attacking your own systems to find weaknesses before criminals do. The golden rule: authorization is everything — the exact same technique is legal with permission and a crime without it.

They test systems with explicit authorization to improve security.

Privacy is about controlling how personal data is collected and used. GDPR (Europe) and similar laws give individuals rights: access their data, correct it, request deletion (right to be forgotten), and know how it is processed. Data minimization means collect only what you need and keep it only as long as necessary. Breaches are costly not just technically but legally — fines can reach millions. Privacy-by-design means building these principles into systems from the start, not bolting them on later.

Collect and retain only the personal data you actually need.

Cybersecurity has many roles: Security Analyst (monitors alerts), Penetration Tester (attacks systems with permission), Security Engineer (builds defenses), Incident Responder (handles breaches), and GRC (governance, risk, compliance). Entry certifications include CompTIA Security+ for fundamentals, then specialized certs like CEH or OSCP for offensive work, CISSP for leadership, and cloud security certs. The field rewards continuous learning — start with networking and Linux fundamentals, then specialize.

CompTIA Security+.