Introduction to Security

What this unit covers

The topics below follow the published Cybersecurity course framework for Unit 1. Cybersecurity publishes no per-unit weighting, so there is no percentage to chase here.

Lessons in this unit

• Threats, Vulnerabilities, and Risk18 min · 3 objectivesDistinguish threats, vulnerabilities, attacks, and risk · Explain why authentication failures are high-value attack paths · Use likelihood and impact to prioritize defenses
• Security Goals and Attack Surfaces18 min · 3 objectivesExplain confidentiality, integrity, availability, and attack surfaces · Apply the idea to evidence from a realistic technology scenario · Justify a decision using security, reliability, cost, and user impact
• Identity, Authentication, and Social Engineering18 min · 3 objectivesExplain identity proof, authentication factors, and social engineering · Apply the idea to evidence from a realistic technology scenario · Justify a decision using security, reliability, cost, and user impact

Every term in Unit 1

All 40 terms we publish for Introduction to Security, with definitions. Reading them through is the fastest way to find the ones you cannot define — then drill those in cram mode until you can produce them without the prompt.

CIA triad

Confidentiality, Integrity and Availability — the three properties security exists to protect. Almost every control maps to one of them, and naming which one is what a question is usually asking.

Defense in depth

Layering independent controls so that one failure does not become a breach. The reason a firewall AND endpoint protection AND access control all exist.

Phishing

Social engineering that induces a target to reveal credentials or run attacker code, usually by impersonating a trusted sender. Targets the human, not the software.

Zero trust

Never trust based on network location. Verify identity, device posture, and context for every request, whether it originates inside or outside the perimeter.

Separation of duties

A sensitive action requires two independent people. Addresses the insider and compromised-account threat, which access control cannot — the actor is authorized.

Confidentiality

Only authorized parties can read the data. Encryption and access control are its main tools.

Integrity

Data has not been altered without authorization. Hashing and digital signatures detect violations; they do not prevent them.

Availability

Authorized users can reach the system when they need it. Redundancy, backups and DDoS protection defend it — and a denial-of-service attack targets this leg alone.

Non-repudiation

A party cannot credibly deny having sent or signed something. Provided by digital signatures, not by encryption.

Authentication vs authorization

Authentication proves who you are; authorization decides what you may do. Passing the first says nothing about the second, and questions swap them deliberately.

Accounting (auditing)

Recording what an authenticated user did. The third A in AAA, and the reason logs exist.

Authentication factors

Something you know (password), something you have (token, phone), something you are (biometric). Location and behavior are sometimes added.

Multifactor authentication

Two or more factors from DIFFERENT categories. A password plus a security question is still one factor, which is why it does not count.

Biometric authentication

Uses a physical trait — fingerprint, face, iris. Convenient and unchangeable, which is the problem: a leaked fingerprint cannot be reset like a password.

False acceptance vs false rejection

False acceptance admits the wrong person; false rejection turns away the right one. Tuning a biometric system trades one against the other.

Single sign-on

One authentication grants access to many systems. Improves usability and concentrates risk — compromise the SSO account and everything downstream falls.

Password best practice

Length matters more than symbol substitution, every account gets a unique password, and a manager makes that possible. Forced frequent rotation is no longer recommended, because it drives predictable patterns.

Social engineering

Manipulating people rather than systems to obtain access or information. It bypasses every technical control, which is why training is a control.

Spear phishing

Phishing tailored to a specific person or organization using researched detail. Far higher success rate than bulk phishing.

Whaling

Spear phishing aimed at senior executives, whose access and authority make the payoff larger.

Vishing and smishing

Phishing by voice call and by SMS. Same technique, different channel — and both defeat an email filter.

Pretexting

Inventing a scenario that justifies the request — posing as IT support, an auditor, a delivery driver. The story is the attack.

Baiting

Leaving something tempting for a victim to use, such as a USB drive in a parking lot, so they carry the compromise inside for you.

Tailgating and piggybacking

Following an authorized person through a controlled door. Tailgating is without their knowledge; piggybacking is with their consent, usually obtained by looking like you belong.

Shoulder surfing

Reading credentials or data directly off someone's screen or keyboard. Privacy filters and screen positioning are the controls.

Dumpster diving

Recovering useful information from discarded material. Shredding and media sanitization policies exist for this.

Principles social engineering exploits

Authority, urgency, scarcity, familiarity, trust and intimidation. A message pressing two or three at once is the pattern to recognize.

Threat, vulnerability, risk

A threat is what could cause harm; a vulnerability is the weakness it would use; risk is the combination of how likely that is and how bad it would be. A vulnerability with no threat carries little risk.

Risk = likelihood × impact

The standard way risk is ranked so that limited resources go to the largest exposures first, rather than to whatever is most alarming.

Risk responses

Accept, avoid, transfer (insurance, outsourcing), or mitigate (apply controls). Reducing risk to zero is not one of the options.

Residual risk

The risk that remains after controls are applied. Every real system has some, and pretending otherwise is the mistake.

Threat actors

Script kiddies use others' tools with little skill; hacktivists act for a cause; organized crime acts for money; insiders already have access; nation-state actors have time, funding and patience.

Advanced persistent threat (APT)

A well-resourced attacker who establishes long-term, quiet access rather than causing immediate damage. Detection, not prevention, is usually what finds them.

Insider threat

Harm from someone with legitimate access — malicious or simply careless. Least privilege and monitoring limit it; a perimeter firewall does nothing.

Zero-day vulnerability

A flaw with no patch available, because the vendor does not yet know or has not yet fixed it. Signature-based defenses cannot match what has never been seen.

Principle of least privilege

Every user and process gets the minimum access needed to do its job, and no more. The single most effective limit on how far a compromise spreads.

AI in cybersecurity, both directions

Defenders use machine learning for anomaly detection and triage at a scale humans cannot match. Attackers use it to write convincing phishing at volume and to generate malware variants. It shifts the speed of the contest, not its shape.

Deepfake and synthetic media

AI-generated audio or video impersonating a real person, used to make a pretexting call credible. The defense is procedural — verify through a known channel — not technical.

Security policy

Written rules stating what is required and permitted. A control that is not written down cannot be audited or enforced.

Acceptable use policy

Defines what users may do with organizational systems. The document that makes disciplinary and legal action possible after a misuse.

What examiners penalize here

• For AP Cybersecurity prompts, do not stop at naming an attack. Tie the attack to the exploited weakness and then recommend a control that actually reduces that risk.
• For a scenario about **confidentiality, integrity, availability, and attack surfaces**, identify the decisive evidence before naming a response. A defensible conclusion here is: The incident affects integrity and confidentiality; restoring a backup alone would not explain the disclosure or stop the attacker.
• For a scenario about **identity proof, authentication factors, and social engineering**, identify the decisive evidence before naming a response. A defensible conclusion here is: Treat the request as likely social engineering; never approve or disclose an unsolicited authentication challenge.

Practice Cybersecurity

Our practice bank is drawn from across the whole course rather than filtered to one unit, which is closer to how the exam asks anyway — it will not tell you which unit a question is testing.

Questions about this unit

All 5 units of AP Cybersecurity

1. Unit 1 · Introduction to Security
2. Unit 2 · Securing Physical Spaces
3. Unit 3 · Securing Networks
4. Unit 4 · Securing Devices
5. Unit 5 · Securing Applications and Data