What Is Cybersecurity and Why Is It Everyone's Job?
Cybersecurity isn't just for IT—it's for anyone with a screen. Explore core concepts and the CIA triad: confidentiality, integrity, and availability.
Why does it matter?
Today, a company's customer list, a family's photo collection, a local merchant's ledger, and our bank accounts all reside in the same place: internet-connected devices. Most attackers don't just target "big corporations"; they look for an open door. More often than not, that door is a link clicked by an employee or a reused password. That is why security is not just IT's responsibility—it is the job of anyone with a screen.
The fundamentals
Information security is built on three core principles, collectively known as the CIA triad:
- Confidentiality: Information is accessible only to those authorized to see it. Storing a payroll spreadsheet in a publicly accessible folder is a breach of confidentiality.
- Integrity: Information cannot be altered without authorization. An attacker modifying the IBAN on an invoice is a breach of integrity.
- Availability: Information is accessible whenever it is needed. A ransomware attack locking down files is a breach of availability.
"Cybersecurity" is the application of these principles to the digital world: devices, networks, accounts, and data. It consists of three pillars: people (awareness, daily habits), processes (policies, permissions, backup routines), and technology (updates, firewalls, encryption). If any one of them is missing, the others cannot stand on their own.
A real-world scenario
Elif, an employee at a small accounting firm, clicks a link in a text message claiming "your package is waiting" and enters the verification code sent to her phone into a phishing page. The attacker gains access to the firm's shared email account and sends an email to clients announcing that "our bank details have changed." Neither a firewall nor antivirus software can prevent this; the only thing that could have stopped it was Elif recognizing the fraudulent message.
Action items
- Classify information: public, internal, confidential.
- Make it a habit to ask: "Who needs access to this information, and why?"
- When in doubt, pause; no one will blame you for taking five minutes to verify.
Keep in mind: Security is not a product; it is a habit.
*This article is part 1 of the 14-part Cybersecurity Awareness series.* Next up: Who are the attackers, and what do they want?