Introduction to the Security Field

Da’Queshia opens the course by challenging common images of security—dark rooms of analysts, lab technicians, or guards at doors. All of those roles belong to the wide world of security, a field that protects people, processes, and technology.

She introduces herself as a security engineer at Google, working on Gmail security: developing new features, fixing vulnerabilities, and collaborating with a diverse team that brings many backgrounds to the table.

1. The Building Blocks of Security

Security programs are built on three inter‑related pillars:

• People – the individuals who design, implement, and operate security controls.
• Processes – the policies, standards, and procedures that guide actions.
• Technology (Tools) – the software and hardware that enforce protection.

Understanding how these pillars interact is the foundation of the entire course.

2. Asset Security

2.1 What Is an Asset?

An asset is anything of value to an organization. Examples include:

• Physical items: buildings, doors, windows, equipment.
• Digital items: data, applications, intellectual property.
• People: employees, customers, partners.

2.2 Asset Inventory & Classification

• Asset inventory – a catalog of every asset that must be protected.
• Asset classification – labeling assets by sensitivity:

Classification determines whether an asset can be disclosed, altered, or destroyed.

2.3 Prioritizing Protection

Because resources are limited, security teams prioritize assets based on risk (the likelihood that a threat will exploit a vulnerability) and the asset’s importance to the organization.

3. Understanding Threats, Vulnerabilities, and Risk

• Threat – any circumstance or event that can negatively impact an asset (e.g., burglars, storms, accidental damage).
• Vulnerability – a weakness that can be exploited by a threat (e.g., a weak lock, cracked wood).
• Risk – the potential impact on confidentiality, integrity, or availability (the CIA triad) when a threat exploits a vulnerability.

Security planning always starts with analyzing assets, threats, and vulnerabilities—the “what, why, and how” of security.

4. Data as a Critical Asset

4.1 The Three States of Data

4.2 Information Security (InfoSec)

Protecting data in all three states is essential to prevent identity theft, financial loss, and reputational damage.

5. Security Plans: Policies, Standards, and Procedures

These three elements together communicate the security plan across the organization.

6. Compliance and the NIST Cybersecurity Framework (CSF)

• Compliance – adhering to internal standards and external regulations (e.g., health, finance, energy).

• NIST CSF – a voluntary framework consisting of:

• Core Functions – Identify, Protect, Detect, Respond, Recover.

• Tiers – Levels 1‑4 (Passive → Adaptive) that gauge performance of each function.
• Profiles – Snapshots of an organization’s current and target states.

The CSF helps organizations manage cybersecurity risk and demonstrate a commitment to protecting customers and brand reputation.

7. Security Controls

7.1 Types of Controls

7.2 Privacy Controls & the Principle of Least Privilege

• Limit access to data based on need‑to‑know.
• Distinguish data owners (decide who can access) from data custodians (handle storage and transport).

7.3 Cryptography Basics

• Encryption – transforms plaintext into unreadable ciphertext; requires a cipher and a key.
• Caesar Cipher – historic shift cipher; vulnerable to brute‑force attacks and single‑key compromise.
• Modern Encryption – uses asymmetric (public/private key pair) and symmetric (single secret key) methods.

7.4 Public Key Infrastructure (PKI)

1. Asymmetric encryption establishes a secure channel (public key for encryption, private key for decryption).
2. Digital certificates issued by a trusted Certificate Authority (CA) bind a public key to an entity’s identity, solving the trust problem.

7.5 Hash Functions

• One‑way algorithms (e.g., SHA‑256) generate a unique hash value for a file.
• Used to verify integrity: any change to the file produces a different hash.

7.6 Access Controls (AAA Framework)

• Single Sign‑On (SSO) reduces login friction but must be combined with Multi‑Factor Authentication (MFA) for security.
• Session hijacking occurs when an attacker steals a valid session token; monitoring logs helps detect it.

8. Defense in Depth

A layered security model that mirrors a medieval castle:

1. Perimeter – authentication (usernames/passwords).
2. Network – firewalls, segmentation.
3. Endpoint – antivirus, host‑based protections.
4. Application – MFA, secure coding.
5. Data – classification, encryption, access controls.

If one layer fails, the next layer still protects the asset.

9. Vulnerability Management

9.1 The Process (Four Steps)

1. Identify – discover vulnerabilities.
2. Consider Exploits – analyze how threats could use them.
3. Prepare Defenses – design mitigations.
4. Evaluate – test and refine defenses.

The cycle repeats continuously because new vulnerabilities (including zero‑day exploits) appear regularly.

9.2 Defense‑in‑Depth Applied to Vulnerabilities

• Layers of controls reduce the chance that a single flaw leads to compromise.

9.3 Public Vulnerability Libraries

• CVE (Common Vulnerabilities and Exposures) – standardized IDs for known flaws.
• CVE Numbering Authority (CNA) reviews submissions against four criteria before assigning an ID.
• NIST National Vulnerability Database provides CVSS (Common Vulnerability Scoring System) scores (0‑10) to prioritize patching.

9.4 Vulnerability Assessment Steps

1. Identification – scanning tools & manual testing.
2. Analysis – confirm and understand each finding.
3. Risk Assessment – assign severity based on impact and likelihood.
4. Remediation – apply patches, change configurations, or implement new controls.

10. Attack Surfaces & Vectors

10.1 Physical vs. Digital Attack Surface

• Physical – devices, people, facilities (e.g., an unattended laptop in a coffee shop).
• Digital – everything beyond the corporate firewall, especially cloud services.

Security hardening reduces the attack surface by limiting entry points.

10.2 Common Attack Vectors

11. Social Engineering & Phishing

• social engineering manipulates human trust to bypass technical controls.
• Stages: Preparation → Pretexting (building trust) → Persuasion → Disconnection.

Phishing kits contain:

1. Malicious attachments.
2. Fake data‑collection forms.
3. Fraudulent web links.

Defenses: anti‑phishing policies, employee training, email filtering, allow/block lists, intrusion‑prevention systems.

12. Malware Overview

Indicators of infection: system slowdown, high CPU usage, unexpected crashes, rapid battery drain, increased electricity costs.

13. Web‑Based Exploits

13.1 Injection Attacks

• Cross‑Site Scripting (XSS) – injects malicious scripts into web pages. Types: Reflected, Stored, DOM‑based.
• SQL Injection – inserts malicious SQL code into database queries, often via unsanitized input fields.

Mitigations: input sanitization, prepared statements, secure coding practices, regular code reviews.

14. Threat Modeling

A structured way to anticipate and mitigate threats.

14.1 General Steps

1. Define Scope – inventory and classify assets.
2. Identify Threat Actors – internal (e.g., disgruntled employee) and external (e.g., hacker).
3. Create Attack Tree – map how threats could reach assets.
4. Characterize Environment – consider users, partners, vendors.
5. Analyze Threats – evaluate existing controls, assign risk scores.
6. Mitigate Risks – decide to avoid, transfer, reduce, or accept each risk.
7. Evaluate Findings – document fixes, lessons learned, and update future models.

14.2 PASTA Framework (Example)

• Process for Attack Simulation and Threat Analysis.
• Seven stages: Business & security objectives → Technical scope → Decomposition → Threat analysis → Vulnerability analysis → Attack modeling → Risk & impact analysis.

The example follows a fitness‑app launch, showing how each stage guides the security team to protect customer data.

15. Recap of the Course Journey

16. What to Do Now – Action Steps

• Create an Asset Inventory – list every physical, digital, and human asset your organization relies on.
• Classify Each Asset – assign Public, Internal‑only, Confidential, or Restricted labels.
• Map Your Attack Surface – document both physical entry points (devices, facilities) and digital entry points (cloud services, external APIs).
• Adopt the AAA Framework:
• Implement MFA for all privileged accounts.
• Review and tighten authorization rules (least privilege, separation of duties).
• Enable audit logging for critical systems and set up alerts for anomalous activity.
• Establish a Vulnerability Management Cycle – schedule regular scans, prioritize CVEs using CVSS scores, and track remediation progress.
• Deploy Defense‑in‑Depth Controls – ensure you have at least one protective layer at perimeter, network, endpoint, application, and data levels.
• Develop a Phishing Awareness Program – conduct simulated phishing campaigns and provide clear reporting mechanisms.
• Start a Threat Modeling Initiative – pick a high‑risk system, follow the six‑step process, and document findings in an attack tree.
• Align with NIST CSF – map your current security activities to Identify, Protect, Detect, Respond, and Recover; identify gaps and set improvement targets.

By completing these steps, you’ll have a concrete foundation for protecting assets, managing risk, and staying ahead of evolving threats.

Congratulations on completing the course material! Your next steps are to apply these concepts in real‑world projects, continue learning about emerging threats, and contribute your unique perspective to any security team you join.

The article emphasizes that security is a multidisciplinary effort built on people, processes, and technology, requiring a clear understanding of assets and their classification. It underscores the importance of a layered defense strategy—combining policies, standards, procedures, and technical controls—to manage risk across data states, threat vectors, and vulnerabilities. Aligning with frameworks such as NIST CSF and implementing continuous vulnerability management ensures systematic risk mitigation. Finally, proactive measures like threat modeling, phishing awareness, and a robust AAA framework empower organizations to stay ahead of evolving attacks.