Security Basics — The Defender's Mindset

What you'll learn

• The CIA triad — the 3 goals of all security
• Common attack types, in plain language
• Social engineering beyond phishing — the other human-targeted tricks
• A famous real-world case study: WannaCry
• Core defenses every organization needs
• How to think like a defender

The three treasures: C-I-A 🛡️

All of security protects three things (memorize this — interviewers ask):

• Confidentiality — only the right people can see the data. (Your medical records stay private.)
• Integrity — data isn't secretly changed. (Your bank balance shows the real number.)
• Availability — the system is up when you need it. (The website works, not knocked offline.)

Every attack breaks at least one. A data leak breaks Confidentiality; tampering breaks Integrity; a DDoS flood breaks Availability.

The common attacks (know these by name):

• Phishing — a fake email/message tricks you into giving a password. (Still the #1 cause of breaches — humans, not code.)
• Malware — malicious software: viruses, ransomware (locks your files for ransom), spyware.
• Brute force — trying millions of passwords until one works.
• Man-in-the-Middle — an attacker secretly sits between you and a site, reading traffic.
• SQL Injection / XSS — tricking a website into running attacker input as code (next lesson).

The core defenses:

• Strong auth + MFA — a password plus a second factor (phone code). Kills most account attacks.
• Encryption — scramble data so a thief gets gibberish.
• Patching — updating software to fix known holes. Boring, and the most effective thing you can do.
• Least privilege — give each account the minimum access it needs. Limits the damage when one is compromised.
• Defense in depth — many layers, so one failure doesn't sink you.

Social engineering — hacking the human, not the machine 🎭

Phishing is the most famous trick, but it's one member of a whole family called social engineering: manipulating people, not code, into breaking security. Know these by name too:

• Pretexting — inventing a believable fake scenario to extract information: "Hi, this is IT support, I need your password to fix your account." No technical hack at all — just a convincing lie.
• Baiting — leaving something tempting (a USB drive labeled "Salaries 2025" in a parking lot) that a curious victim plugs in themselves, installing malware.
• Tailgating — physically following an employee through a secure door without badging in, relying on politeness ("can you hold the door?").
• Vishing / Smishing — phishing over voice calls or SMS text instead of email — "Your bank card is blocked, call this number now."

Why this matters: you can buy the best firewall on Earth, but it does nothing against an employee who reads their password over the phone to someone who "sounds official." This is why security awareness training for humans is treated as seriously as technical controls.

Real-world case study: WannaCry (2017) 🔍

In May 2017, the WannaCry ransomware infected over 200,000 computers across 150 countries in days — including hospitals in the UK's NHS, forcing ambulances to be diverted and surgeries cancelled. It encrypted victims' files and demanded Bitcoin ransom to unlock them, a direct attack on Availability and Integrity at once.

The devastating detail: WannaCry spread through a Windows vulnerability called EternalBlue — and Microsoft had already released a patch fixing it two months before the attack. Every infected machine was running software that was already, provably fixable. This is the single most cited real-world proof of the lesson's own claim: patching is unglamorous, but it is the most effective defense that exists — and skipping it is exactly how a known, fixed hole becomes a global incident.

Summary

• CIA triad: Confidentiality, Integrity, Availability — the goals of all security
• Attacks: phishing, malware, brute force, MITM, injection
• Social engineering also includes pretexting, baiting, tailgating, vishing/smishing
• WannaCry (2017) proved patching's value the hard way — a known, fixed flaw still caused a global incident
• Defenses: MFA, encryption, patching, least privilege, defense in depth
• You wrote a real CIA-classifier function

Defender's mindset: always ask "what could go wrong, and which of C-I-A does it threaten?" Next: Web Security — the specific attacks against websites, with hands-on detection.