An Introduction to Cyber Security

Watch: An Introduction to Cyber Security

Cyber security is no longer a niche concern relegated to IT departments. In an era where businesses of every size depend on digital infrastructure, understanding cyber security fundamentals has become essential for business leaders, board members, and managers across all functions. This article provides a practical overview of the concepts, threats, and risk management approaches that every organization needs to understand.

By Jonathan Sharrock, CEO, Cyber Citadel. Originally published in the 2nd Edition 2021 Across Borders magazine, p. 47.

A malicious attacker will breach your IT network. It's a statistical fact now.

What is Cyber Security?

At its core, cyber security is the practice of protecting systems, networks, and data from digital attacks, unauthorized access, and damage. It encompasses a broad range of disciplines, from network security and application security to information governance and incident response. The goal is not to eliminate all risk, which is impossible in a connected world, but to manage risk to an acceptable level that supports the organization's objectives.

Effective cyber security operates on three foundational principles, often referred to as the CIA triad: Confidentiality, ensuring that information is accessible only to those authorized to view it; Integrity, ensuring that data is accurate, complete, and has not been tampered with; and Availability, ensuring that systems and data are accessible when needed. Every security control, policy, and process ultimately serves to protect one or more of these three principles.

Common Threat Types

The threat landscape facing modern organizations is diverse and constantly evolving. Understanding the major categories of threats is the first step toward building effective defences:

Malware: Malicious software including viruses, trojans, worms, and spyware designed to damage, disrupt, or gain unauthorized access to systems. Modern malware is often polymorphic, meaning it changes its code to evade detection.
Ransomware: A specific category of malware that encrypts an organization's data and demands payment for the decryption key. Ransomware has evolved into a major criminal industry with sophisticated operators and affiliate models.
Phishing: Social engineering attacks that use deceptive emails, messages, or websites to trick individuals into revealing credentials, installing malware, or transferring funds. Spear phishing targets specific individuals with personalized content.
Insider Threats: Risks originating from within the organization, whether through malicious intent, negligence, or compromised credentials. Insider threats are particularly challenging because the individuals involved already have legitimate access.
Distributed Denial of Service (DDoS): Attacks that overwhelm systems or networks with traffic to render them unavailable, disrupting business operations and potentially masking other malicious activities.

The most important insight for business leaders is that cyber security is a risk management discipline, not a technology problem. The right level of investment and the right controls depend on your specific business context, regulatory environment, and risk appetite.

Risk Management Basics

Cyber security risk management follows a structured process: identify your assets and their value, assess the threats and vulnerabilities that could affect them, evaluate the likelihood and impact of potential incidents, and implement controls that reduce risk to an acceptable level. This process should be continuous, as both the threat landscape and your organization's digital footprint evolve over time.

Risk assessments should consider not only the direct costs of a security incident, such as remediation expenses and regulatory fines, but also indirect costs including reputational damage, lost business, and operational disruption. For many organizations, the indirect costs far exceed the direct costs, making a compelling case for proactive investment in security.

Building a Security Foundation

Organizations beginning their cyber security journey should focus on establishing fundamentals before pursuing advanced capabilities. The following measures address the most common attack vectors and provide a solid foundation for a security programme:

Patch Management: Keeping software and systems up to date with the latest security patches eliminates known vulnerabilities that attackers routinely exploit.
Access Controls: Implementing the principle of least privilege, ensuring that users have only the access they need for their role, and enforcing multi-factor authentication for all remote and privileged access.
Backup and Recovery: Maintaining regular, tested backups of critical data and systems, stored securely and separately from production systems, provides resilience against ransomware and data loss.
Security Awareness: Training employees to recognise and respond to common threats is one of the most cost-effective security investments an organization can make.
Incident Response Planning: Having a tested plan for responding to security incidents ensures that the organization can act quickly and effectively when an incident occurs, minimising damage and recovery time.

Getting Started

Getting on top of cybersecurity doesn't have to be daunting or expensive. The first step is always to understand the risk landscape of your company and then critically assess network security. This starts with a Threat Risk Assessment followed by a Security Posture Review. These low-budget, high-reward procedures tell you what your risks are, and whether the resources you have at your disposal are capable of mitigating them.

Vulnerability Assessment and Penetration Testing

The most crucial test of company security is a vulnerability assessment and penetration test (VAPT), which should be run at least once a year. It is important to realise this is a dual procedure — a vulnerability assessment is an automated scan, whereas a penetration test is a human-led investigation.

People and Process

Fortifying your digital infrastructure is only part of the solution. Ensuring the wellbeing of an organisation is a collective effort. Training employees in cyber awareness is crucial — the majority of attacks result from human error or poor company practice.

Network Architecture

The principle of least privilege should always be applied: give away the minimum amount of access required to facilitate the job, nothing more. Network segmentation is also critical — isolating parts of your network prevents lateral movement in the event of a breach.

Backup Strategy

Only by making backups, and backups of those backups, can you be sure your data is always recoverable. At least one backup should be kept offline, disconnected from the network on an external hard drive.

The Essential 8

The Australian government recommends an 'Essential 8' improvements a company can make. Some are as simple as Multi-factor Authentication (MFA) or restricting privileges. The Essential 8 guidance is a great place to start.