1 · Foundations

Before we can reason about attackers, defenses, or the way artificial intelligence is reshaping both, we need a shared vocabulary. The terms in this chapter recur on every page that follows, and the ideas behind them — risk, the properties we protect, the tools of cryptography, and the principles that tie them together — form the scaffolding for everything else. Read slowly here; the frontier material lands far harder once these fundamentals are solid.

Security is risk management, not perfection

The single most important shift in thinking for a newcomer is this: security is not about making a system invulnerable. That goal is unattainable, and chasing it wastes resources. Security is about managing risk — deciding which dangers to mitigate, which to transfer to someone else (insurance, a vendor), which to simply accept, and which to avoid by not doing the risky thing at all. Because effort and money are finite, you spend them where the potential loss is largest.

A useful working definition is that risk is roughly the product of likelihood and impact — how probable an adverse event is, multiplied by how badly it would hurt if it happened. A weakness an attacker is unlikely to find, that would cause trivial damage even if exploited, is a low-risk weakness. A flaw in your payment system that is easy to reach and would expose every customer’s card is a high-risk one. Two organizations with identical technology can rationally make different security decisions because their assets, and therefore their impacts, differ.

Imagine a mid-sized dental clinic, “Maple Dental,” weighing two upgrades: a backup generator and an encrypted backup of patient records. The generator addresses a low-likelihood, moderate-impact risk (a multi-day power outage). The encrypted backup addresses a higher-likelihood, severe-impact risk (ransomware that locks the records and triggers regulatory penalties). With one budget, risk thinking tells the clinic which to fund first.

What we are protecting: the CIA triad

Security exists to preserve three properties of information and systems, known together as the CIA triad.

Confidentiality means only authorized parties can read the data. When attackers exploited an unpatched flaw in the Apache Struts web framework at Equifax in 2017 and exfiltrated the personal records of roughly 147 million people, that was a catastrophic confidentiality failure. A subtler example: a hospital whose clinicians suddenly cannot open patient records is suffering a confidentiality-adjacent failure of access control — though as we will see, the same incident often damages more than one property at once.

Integrity means data and systems are not altered without authorization, and that unauthorized changes can be detected. Availability means the system is present and usable when legitimate users need it. Ransomware is the textbook attack on both: by encrypting files it destroys availability, and by tampering with them it violates integrity, all while the original data may still be confidential. That is why ransomware is so damaging — it strikes two legs of the triad simultaneously.

Two modern extensions are worth naming alongside the triad. Authenticity is the guarantee that an entity really is who or what it claims to be. Non-repudiation is the guarantee that someone cannot credibly deny having taken an action — the digital equivalent of a signature they cannot disown.

Core terminology

With the triad in place, a small set of terms lets us talk precisely about how protection fails. An asset is anything worth protecting: data, a system, money, or reputation. A threat is a potential cause of harm, whether a person (an attacker) or an event (a flood). A vulnerability is a weakness a threat can use — an unpatched server, a reused password. An exploit is the specific technique or code that turns a vulnerability into a real compromise. Risk, as above, is the expected loss. And the attack surface is the sum of every way in — every login page, API, employee inbox, and third-party integration.

Term	Plain meaning
Asset	The thing worth protecting (data, system, money, reputation).
Threat	A potential cause of harm — a who or a what.
Vulnerability	A weakness that a threat can use.
Exploit	The technique or code that turns a vulnerability into a compromise.
Risk	The expected loss ≈ likelihood × impact.
Attack surface	The sum of all the ways in.

The people behind threats span a wide spectrum of capability. At the low end sit opportunists and “script kiddies” running tools they did not write. Above them are professional cybercrime crews, increasingly selling their wares as services for hire. Then come hacktivists pursuing a cause, malicious or careless insiders who already hold legitimate access, and at the top, well-funded nation-state groups. The defining shift of this decade is that frontier AI raises the floor: a low-skill actor can now operate near the capability once reserved for the high end. We examine that claim closely in Mythos.

Cryptography essentials

You do not need the underlying mathematics to use cryptography well; you need to know what each tool guarantees. Symmetric encryption, such as AES, uses one shared secret key to both lock and unlock data. It is fast and ideal for bulk data, but both parties must somehow already share the key. Asymmetric encryption, such as RSA or elliptic-curve cryptography, uses a paired public and private key; anyone can encrypt to your public key, but only your private key can decrypt, which neatly solves the key-distribution problem and underpins digital signatures.

Hashing, such as SHA-256, produces a fixed-length, one-way fingerprint of data. Because it cannot be reversed, it is used for integrity checks and for storing passwords — but only safely when each password is combined with a unique random salt before hashing. The 2012 LinkedIn breach is the cautionary tale: roughly 6.5 million passwords had been stored as unsalted SHA-1 hashes, so attackers could crack vast numbers of them with precomputed tables.

Digital signatures combine hashing and asymmetric keys to prove authenticity, integrity, and non-repudiation at once. Signed software updates rely on this: your device trusts an update because it carries the vendor’s signature. That also reveals the danger — an attacker who steals the signing key can sign malware that every customer’s machine will trust, which is precisely why signing keys are guarded so jealously.

Finally, TLS (the protocol behind the HTTPS padlock) and the public-key infrastructure (PKI) behind it are how the web bootstraps trust between strangers. A certificate authority vouches for a website’s identity by signing its certificate; your browser trusts the authority, and therefore trusts the site, allowing an encrypted, authenticated connection without you ever having met the server before.

Authentication and authorization

Two words that sound alike carry distinct meanings. Authentication (AuthN) answers who are you? Authorization (AuthZ) answers what are you allowed to do? Confusing the two is a common source of breaches — proving identity is not the same as granting permission.

Authentication has been on a steady march away from the password. Passwords gave way to multi-factor authentication (MFA), which adds a second factor such as a code or a phone prompt. But MFA is not invincible. In the 2022 Uber incident, an attacker who had obtained a contractor’s credentials bombarded them with repeated push notifications until, worn down, the user approved one — an attack known as MFA fatigue or push-bombing. The response to such weaknesses is passkeys and FIDO2, a passwordless approach where a private key never leaves your device and there is no shared secret to phish or fatigue out of you. Meanwhile OAuth and single sign-on (SSO) federate identity so users authenticate once rather than scattering passwords across dozens of sites. The overarching trend: identity is the new perimeter.

Network fundamentals and the death of the perimeter

The classic network controls — firewalls that filter traffic, segmentation that walls off zones, VPNs that extend trusted access, and DNS that maps names to addresses — were built around a comfortable assumption: there is an inside that is trusted and an outside that is not. That assumption is now false. With cloud platforms, SaaS applications, and remote work, there is no clean edge; “inside the network” no longer implies “trusted.”

The Capital One breach of 2019 illustrates the new reality. A misconfigured web application firewall in the cloud allowed a server-side request forgery (SSRF) attack to reach internal metadata and steal credentials, exposing data on over 100 million applicants. No castle wall was breached; a misconfiguration inside the supposedly trusted environment was enough. This dissolution of the boundary is the on-ramp to Zero Trust, which we develop in Block 3.

The three principles that tie it together

Three principles run through everything in this class. Least privilege means granting the minimum access required, for the minimum time — so a compromised account or stolen key can reach as little as possible. Defense in depth means layering controls, so that one failure is not fatal; had Equifax’s web framework been patched, or its data better segmented, or its outbound traffic monitored, any one layer might have caught the intrusion. Assume breach means designing as though the attacker is already inside, and asking how you would detect and contain them.

Principle	What it asks you to do
Least privilege	Grant the minimum access, for the minimum time.
Defense in depth	Build layers, so one failure is survivable.
Assume breach	Design as if the attacker is already inside.

With the vocabulary, the properties we protect, the tools of cryptography, and the guiding principles in hand, we are ready to look at who is actually attacking these systems today and how the ground is shifting beneath defenders — the subject of the threat landscape.