Topic 2.1
Cyber Foundations
Cybersecurity foundations are the principles, processes, and controls used to protect people, information, devices, systems, and physical spaces. Effective security connects digital protection with real-world access, behavior, and organizational responsibility.
The confidentiality, integrity, and availability triad
The CIA triad is a foundational model for thinking about what security should protect. A single incident can affect one, two, or all three objectives.
Confidentiality
Information is accessible only to authorized people, processes, or systems. Examples include encrypting student records, restricting personnel files, and preventing shoulder surfing.
Integrity
Information and systems remain accurate, complete, and protected from unauthorized change. Examples include change logs, digital signatures, version control, and approval workflows for grade updates.
Availability
Authorized users can access information and services when needed. Examples include backups, reliable power, redundant systems, maintenance, and recovery plans.
| Scenario | Primary objective affected | Why |
|---|---|---|
| An unauthorized person reads private counseling records. | Confidentiality | Protected information was disclosed to someone without permission. |
| A student changes an exam score without approval. | Integrity | Information was altered without authorization. |
| A server failure prevents access to the learning platform. | Availability | Authorized users cannot reach a needed service. |
| Ransomware encrypts files and threatens to publish copies. | Availability and confidentiality | Files may become unusable and information may be exposed. |
Security requires balance
A control that maximizes confidentiality but makes an essential emergency system impossible to access may create a serious availability problem. Security decisions should reflect the asset, users, mission, and consequences.
Assets, threats, vulnerabilities, risks, and controls
These terms describe different parts of a security problem. Using them precisely makes risk discussions clearer.
| Term | Meaning | School example |
|---|---|---|
| Asset | Something valuable that should be protected. | Student records, laptops, network access, staff safety, or the school building |
| Threat | A circumstance, event, or actor with the potential to cause harm. | A thief, fire, power outage, malicious insider, phishing campaign, or accidental deletion |
| Vulnerability | A weakness or condition that a threat could exploit. | An unlocked server-room door, reused password, missing update, or untested backup |
| Risk | The potential for harm, usually considered through likelihood and impact. | The chance and consequence of unauthorized access to the student information system |
| Control | A safeguard or countermeasure that changes risk. | A badge reader, firewall, policy, backup, awareness training, or access review |
| Residual risk | Risk that remains after controls are applied. | A locked and monitored server room still has some risk from fire or authorized misuse |
A simple reasoning model
Risk ≈ Likelihood × Impact
This is a useful classroom model, not a universal equation. Real assessments also consider existing controls, uncertainty, exposure, threat capability, asset importance, and organizational risk tolerance.
Physical security and digital security
Physical and digital security overlap. Someone who reaches a device, cable, server, backup, or unlocked screen may bypass controls that appear strong from across the internet.
Protecting places and equipment
- Locks, barriers, badge readers, guards, and visitor procedures
- Cameras, alarms, lighting, and environmental sensors
- Secure storage for devices, backups, keys, and documents
- Fire detection, power protection, cooling, and water controls
- Restricted areas for servers, exams, networking equipment, and records
Protecting systems and information
- Authentication, authorization, encryption, and access control
- Firewalls, endpoint protection, monitoring, and segmentation
- Secure configuration, patching, backups, and recovery testing
- Logging, alerts, account reviews, and incident response
- Data classification, retention rules, and secure deletion
Real-world examples
School computer lab
Standard student accounts, locked administrator settings, filtered network access, automatic screen locks, asset labels, and staff supervision work as different layers.
Office visitor
Reception verifies identity, issues a temporary badge, records the visit, limits access, provides an escort, and collects the badge at departure.
Server room
A locked door, individual badges, access logs, cameras, environmental sensors, fire suppression, redundant power, and remote monitoring protect both equipment and services.
Lost school laptop
Full-device encryption protects stored data, MFA protects accounts, management tools support remote action, and inventory records help incident response.
Restricted exam area
Entry lists, supervised access, device restrictions, sealed materials, audit logs, and separation of duties protect exam confidentiality and integrity.
Network closet
Locked cabinets, limited key access, labeled cables, tamper checks, segmented management access, and configuration backups reduce physical and digital risk.
Authentication, authorization, and access control
Access control decides who or what may interact with an asset and under which conditions.
- Identification A user or device claims an identity, such as a username, account, badge number, or device certificate.
- Authentication The system verifies the claim using something known, possessed, inherent, or otherwise trusted.
- Authorization The system determines which resources and actions the authenticated identity is permitted to use.
- Accountability Logs and reviews connect important actions to identities so activity can be monitored and investigated.
Grant only what is needed
Users, devices, applications, and processes should receive only the minimum resources and permissions necessary for assigned tasks, and only for as long as needed.
A student may submit an assignment but cannot edit another student’s work. A teacher may update grades for assigned classes but cannot change server security settings.
Review, change, and remove
Access should change when a role changes and end when it is no longer needed. Dormant accounts, shared credentials, old badges, and excessive privileges create avoidable risk.
Role-based access control (RBAC) can assign standard permissions based on roles such as student, teacher, counselor, technician, or visitor.
Security controls and defense in depth
Defense in depth uses multiple, different layers so that one failed control does not automatically expose an asset. Layers should prevent, deter, detect, delay, respond to, and support recovery from incidents.
| Control category | Purpose | Examples |
|---|---|---|
| Administrative | Direct people and processes through governance and documented expectations. | Policies, procedures, risk assessments, training, background checks, vendor requirements, and incident plans |
| Technical | Use technology to enforce, monitor, or recover security. | MFA, encryption, firewalls, endpoint protection, access lists, logging, backups, and network segmentation |
| Physical | Protect people, facilities, devices, media, and infrastructure from physical access or hazards. | Locks, gates, badges, guards, cameras, cabinets, alarms, fire controls, and environmental sensors |
Layered school-record example
A policy defines who may access records; training explains correct handling; MFA verifies users; role-based permissions limit actions; encryption protects stored and transmitted data; logs support detection; backups support recovery; and locked offices protect screens and paper copies.
Risk assessment and basic threat modeling
Risk assessment identifies and prioritizes possible harm. Threat modeling examines how a particular system, space, or process could be misused or fail.
- Define scope and assets Identify the space, system, users, data, dependencies, and mission being assessed.
- Identify threats Consider malicious actors, accidents, equipment failure, environmental events, supply-chain issues, and process mistakes.
- Find vulnerabilities Review physical access, accounts, configurations, software, procedures, training, dependencies, and recovery capability.
- Estimate likelihood and impact Use evidence and stated assumptions to rate how plausible and harmful each scenario may be.
- Review existing controls Determine which safeguards reduce the likelihood or impact and where gaps remain.
- Select a response Mitigate, avoid, transfer, or knowingly accept risk within authorized limits.
- Assign and document Identify owners, deadlines, required resources, dependencies, and evidence of completion.
- Monitor and reassess Risks change as threats, users, technology, spaces, and organizational priorities change.
Basic threat-model questions
- What are we protecting?
- Who needs legitimate access?
- What could go wrong, accidentally or deliberately?
- Which weaknesses make that scenario possible?
- What would the impact be?
- Which control most directly reduces the risk?
- How will we know the control works?
Example: school server room
Asset: servers, network equipment, data, and service
availability.
Threat: unauthorized entry, fire, water, power loss, or
misuse by an authorized person.
Vulnerability: shared key, no access review, or missing
environmental alert.
Controls: individual badges, least privilege, logs,
sensors, backup power, monitoring, and tested recovery.
Policies, procedures, and user responsibilities
What and why
A policy states an organization’s security expectations, scope, responsibilities, authority, and required outcomes. Examples include acceptable use, access control, visitor management, data handling, and incident reporting policies.
How and when
A procedure gives repeatable steps for completing a task, such as issuing a visitor badge, reporting a lost device, granting account access, restoring a backup, or responding to an alarm.
Every user is part of the control system
- Use individual accounts and approved authentication methods.
- Protect badges, keys, devices, passwords, and recovery information.
- Lock screens and secure spaces when leaving them unattended.
- Challenge or report unusual access according to policy; do not create personal risk.
- Do not hold restricted doors for unidentified people.
- Handle, store, share, and delete information according to its classification.
- Report lost equipment, suspicious messages, damaged controls, and mistakes promptly.
- Complete required training and follow approved procedures rather than inventing shortcuts.
A healthy reporting culture improves security
Users should be able to report mistakes and suspicious events quickly without fear of automatic blame. Early reporting gives defenders more time to protect other people, accounts, devices, and spaces.
Watch: cybersecurity foundations in practice
As you watch, identify the asset, CIA objective, threat, vulnerability, control category, and remaining risk in each example.
Interactive knowledge check
Secure the Space Challenge
Complete all ten questions, check your score, and review the explanation for every answer. The quiz runs in your browser and does not collect personal information.
What the quiz covers
- The CIA triad and core risk vocabulary
- Physical and digital security, least privilege, and defense in depth
- Authentication, authorization, and administrative, technical, and physical controls
- Risk assessment, threat modeling, policies, procedures, and user responsibilities
AP® Cybersecurity study support
The NIST Cybersecurity Framework 2.0 organizes high-level security outcomes into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Use them as a memory aid for the security lifecycle rather than as a replacement for specific controls.
Asset owner
The person or role accountable for decisions about an asset.
Control
A safeguard or countermeasure intended to modify risk.
Defense in depth
A strategy that combines people, processes, and technology across multiple layers.
Residual risk
The risk remaining after controls are selected and applied.
Risk tolerance
The level or type of risk an authorized organization is prepared to accept.
Threat model
A structured view of assets, possible threats, weaknesses, impacts, and defenses.
Continue your study
Foundational controls include encryption and secure computing practices. Review how cryptography protects digital information, explore broader computer science study materials, or organize your revision using the guide to self-studying for an AP exam.
Trusted defensive references
Frequently asked questions
1. What are cybersecurity foundations?
Cybersecurity foundations are the principles, roles, processes, and controls used to understand risk and protect people, spaces, devices, systems, services, and information.
2. What does the CIA triad mean?
Confidentiality limits access to authorized parties, integrity protects accuracy and authorized change, and availability ensures authorized users can access needed systems and information.
3. What is the difference between a threat, vulnerability, and risk?
A threat can cause harm, a vulnerability is a weakness or condition that could be exploited, and risk reflects the potential harm based on factors such as likelihood, impact, and existing controls.
4. Why is physical security part of cybersecurity?
Physical access to devices, cables, servers, backups, screens, or records can expose data or bypass digital controls. Physical and digital protections therefore work together.
5. What is the principle of least privilege?
Least privilege gives each user, device, application, or process only the minimum resources and permissions needed to complete assigned tasks.
6. What is defense in depth?
Defense in depth combines multiple administrative, technical, and physical layers so that the failure of one control does not automatically expose an asset.
7. How are authentication and authorization different?
Authentication verifies an identity claim. Authorization determines what an authenticated identity is permitted to access or do.
8. What are administrative, technical, and physical controls?
Administrative controls direct people and processes, technical controls use technology to enforce or monitor security, and physical controls protect facilities, equipment, media, and people.
9. What happens during a basic risk assessment?
The assessor defines scope and assets, identifies threats and vulnerabilities, estimates likelihood and impact, reviews existing controls, selects responses, assigns owners, and monitors changes.
10. What security responsibilities do users have?
Users should follow policies and procedures, protect accounts and devices, secure physical spaces, handle data correctly, complete training, avoid unauthorized shortcuts, and report incidents promptly.
