The Foundations of Cybersecurity

Professionals organize almost every control around three goals called the CIA Triad — Confidentiality, Integrity, and Availability. The acronym is not the spy agency. It is a map: when something goes wrong, you ask which goal failed first, because the first fix changes. A leaked payroll spreadsheet is not the same failure as a silently altered balance, and neither is the same as a hospital system that will not load. Every password, update, backup, and lock screen you will practice later maps back to at least one of these pillars.

Confidentiality is the mechanism that keeps information visible only to authorized people, processes, or systems. Unauthorized viewing is enough to break it — a stranger reading your inbox at a café, a screenshot of a health record posted online, a stolen session cookie used from another city. Encryption, access control, and need-to-know exist because copies travel. If the wrong eyes can read a secret, confidentiality already failed even when nothing was edited and the system stayed online.

Integrity is the mechanism that keeps information accurate and complete as authorized creators intended. An attacker who changes a blood type in a chart, a grade in a portal, or a payee on an invoice did not need to "steal" the file to cause harm — they needed to write. Hashing, digital signatures, write permissions, and audit logs exist because silent change is often more dangerous than loud theft. If you cannot trust the bytes, every decision on top of them is compromised.

Availability is the mechanism that keeps systems usable for authorized people when they need them. Encrypting a vault and dropping the only key in the ocean fails the mission even if no outsider ever reads the data. Floods of junk traffic, ransomware that locks files, full disks, cut cables, and untested backups all break availability. Redundancy, capacity planning, and restore drills exist because uptime is part of security, not a separate ops hobby.

Not everyone who "hacks" is a criminal. Skill with systems is neutral the way locksmith skill is neutral. What decides the line is authorization and intent. A white-hat (ethical) practitioner tests systems with explicit permission — usually written Rules of Engagement — to find weaknesses before criminals do, and reports them so owners can fix. That is the career direction this course trains toward. Curiosity without permission is not a white-hat badge.

A black-hat attacker breaks in to steal, spy, extort, sabotage, or vandalize without authorization. This course never teaches you to become one. It teaches you to recognize their incentives so you can choose controls: unique passwords against stuffing, MFA against stolen passwords, screen locks against physical access, skepticism against social engineering. Grey-hat behavior sits in a legal and ethical blur — probing without clear permission, then reporting or demanding payment. "I meant well" rarely impresses courts or employers. If the owner did not authorize the test, do not run it.

Credential stuffing is the industrial version of password reuse. Attackers take username/password pairs leaked from one breach and try them automatically on other services — mail, banks, cloud drives, work SSO. They are not "guessing your personality." They are replaying secrets you already typed somewhere else. Unique passwords (ideally via a password manager) contain the blast radius: a shopping-site leak should not open work email. Screen lock is the physical twin of that idea. An unlocked laptop at a café hands confidentiality to whoever sits down; stuffing hands it to whoever bought a dump. Both are unauthorized access. Both start with a habit you can fix without hacking anyone.

On your own device only — never someone else's. The commands below show which identity the OS thinks you are. They do not scan networks, crack passwords, or touch other people's accounts. After you run them, open Settings and confirm a real screen lock is on. That lock is your first confidentiality control against physical access.

whoami

whoami
id
uname -a

mkdir -p "$HOME/cyberlium-lab"
cd "$HOME/cyberlium-lab"
pwd
date
ls -la

New-Item -ItemType Directory -Force -Path "$env:USERPROFILE\cyberlium-lab" | Out-Null
  Set-Location "$env:USERPROFILE\cyberlium-lab"

Get-ChildItem

You planted the foundation: CIA as three mechanisms, hats separated by permission, credential stuffing as reuse at scale, and screen lock as a first control you can verify tonight. Next — Cybersecurity in 2026 — we look at how AI-written phishing, deepfake voice, always-on IoT, and supply-chain awareness raise the pressure on those same pillars.