Cybersecurity Fundamentals
Cybersecurity Fundamentals covers the vocabulary and threat landscape that every other Fortinet domain assumes: the security principles, who attacks and why, how common attacks work, how risk is expressed, and which frameworks structure a defense program.
Core principles
- CIA triad: confidentiality (only authorized readers), integrity (data is not altered improperly), availability (systems respond when needed).
- AAA: authentication proves identity, authorization decides permissions, accounting records actions for audit and non-repudiation.
- Supporting principles: least privilege, defense in depth, separation of duties, secure defaults, and fail-safe behavior.
Threat actors and motives
Script kiddies seek notoriety using others' tools; hacktivists pursue ideology; insiders exploit legitimate access; organized crime seeks profit through ransomware and fraud; nation-state APTs pursue espionage, persistence and disruption. Ransomware-as-a-service affiliates and initial access brokers have industrialized the criminal side.
Common attacks
Phishing and spear-phishing remain the top initial access vector, followed by exploitation of unpatched public-facing services, credential stuffing against reused passwords, supply chain compromise, denial of service, and man-in-the-middle interception on unprotected channels. Ransomware commonly adds double extortion: encryption plus threatened data leak.
Risk and controls
Risk is a function of the likelihood a threat exploits a vulnerability and the resulting impact. A threat is a potential actor or event; a vulnerability is a weakness; risk is the combination applied to an asset. Controls are preventive (stop it), detective (notice it) or corrective (recover), and can be administrative, technical or physical.
Frameworks and models
- NIST CSF organizes outcomes as Identify, Protect, Detect, Respond, Recover, with Govern added in version 2.0.
- ISO/IEC 27001 defines requirements for an information security management system.
- MITRE ATT&CK catalogs tactics (the adversary's goal) and techniques (how it is achieved).
- Zero trust means verify explicitly, grant least privilege, and assume breach - identity and device posture replace implicit network trust.
Worked example
A finance workstation opens a macro document and begins beaconing to a rare domain. Using ATT&CK, the sequence maps to initial access via phishing, execution through a scripting interpreter, and command-and-control over an application-layer protocol. That mapping tells you where to place controls: mail filtering and macro blocking prevent, EDR detects the process chain, and a DNS or firewall block corrects the active channel.
Traps that cost marks
- Swapping threat, vulnerability and risk.
- Confusing authentication with authorization.
- Confusing encryption (reversible with a key) with hashing (one-way).
- Assuming compliance certification proves security.
- Reading zero trust as "trust nothing and remove all firewalls" rather than continuous verification.