What is cybersecurity?

Cybersecurity is critically important for individuals, governments, and businesses alike, as cyberattacks can profoundly disrupt operations, cause significant financial loss, and inflict lasting reputational damage. It's a common misconception that only large, well-known organizations are at risk, but in reality, every business, person, or object connected to the internet is a potential target.

Cybercriminals are constantly scanning the digital landscape looking for two types of targets:

• A target of intent is specifically singled out due to its high profile or valuable data.
• A target of opportunity is defined by an unpatched system or unprotected network.

Regardless of size or fame, the digital risks are real for everyone. For example, consider the "WannaCry" cyberattack in 2017. This was a widespread assault involving ransomware, a type of malicious software (malware) that makes a system’s data or files inaccessible until a payment (ransom) is paid.

WannaCry rapidly infected hundreds of thousands of computer systems across more than 150 countries and notably brought down parts of the U.K.'s National Health Service (NHS). Organizations hit by WannaCry faced a difficult choice: pay the criminals, attempt a difficult data recovery process, or wipe their systems. This single event reportedly led to billions of dollars in losses and severely disrupted essential health services, showing just how thoroughly such a cyberattack can cripple business operations.

Beyond direct attacks on an organization, the interconnected nature of modern business means that a breach in one company can ripple through its entire network of customers and partners, impacting even seemingly unrelated entities in a phenomenon referred to as a “supply chain attack.” This aspect highlights the expanded attack surface and the shared responsibility in today's digital ecosystem.

As you see, cybersecurity professionals are essential for organizations that want to ensure continuous operation and client confidence in the face of evolving cyber threats.

As you've learned, cyber threats can emerge from many directions. Effectively protecting an organization means defending across multiple fronts simultaneously. That's why many cybersecurity professionals specialize in specific domains, much like doctors specialize in disciplines such as cardiology or pediatrics. Here are some of the key domains within cybersecurity:


Security and risk management

Professionals in this domain lay the groundwork for an organization's defenses. They create robust security policies, develop strategies to reduce potential risks, and ensure the organization complies with relevant regulations.


Asset security

Asset security specialists focus on protecting an organization's valuable resources. Their expertise covers tracking assets like customer data, computer servers, or software applications throughout the product lifecycle. They focus on implementing appropriate protection methods, and ensuring secure disposal when assets reach end-of-life. Asset security specialists constantly evaluate which assets require the highest levels of protection based on their value and sensitivity.


Security architecture and engineering

Experts in this domain design the fundamental systems that keep data safe. A core principle is the layering of defenses, meaning multiple protective measures work together so that if one safeguard fails, others remain in place. For example, an organization might require that all employees install multi-factor authentication (MFA), and they may also have a network firewall to prohibit logins from unusual locations.


Software and development security

Professionals in this domain integrate security into the software development process from the very beginning. They work to identify and fix vulnerabilities in applications before they are released, ensuring that software is secure throughout its entire lifecycle. This proactive approach helps to prevent flaws that attackers could exploit.


Communication and network security

As data flows across networks, specialists in communication and network security ensure it remains protected at every step. They monitor traffic patterns, establish secure channels for information exchange, and manage security across physical network infrastructure, wireless communications, and cloud environments. Their expertise is crucial for bridging the complex boundaries of today's hybrid workforces.


Identity and access management

Professionals in identity and access management control who can access which resources within an organization. They implement authentication systems, manage user credentials, and enforce the principle of "least privilege," ensuring individuals only have access to the resources absolutely necessary for their role.


Security assessment and testing

Cybersecurity professionals in this domain proactively hunt for weaknesses in systems before attackers can exploit them. They achieve this through methods like penetration testing, vulnerability scanning, and security audits, continuously evaluating defenses and recommending improvements.


Security operations

Security operations professionals are on the front lines, leading responses when security incidents occur. Their daily responsibilities include monitoring security tools, investigating alerts, coordinating incident response, and implementing recovery procedures to get systems back online.

Cybersecurity professionals face complex threats. To simplify defense, they use security frameworks to understand what to protect and how to protect it. There are many security frameworks out there, each one outlining core concepts and strategies for implementing, maintaining, and improving cybersecurity. The specific tools and techniques used are called “controls.”

The National Institute of Standards and Technology (NIST) is a U.S. government agency that provides standards, guidelines, and best practices to help organizations strengthen their security posture. They also developed one of the more widely-used frameworks, known as the NIST Cybersecurity Framework (CSF). This framework outlines five core functions:

• Govern: Governance is key to establishing policies, procedures, and processes that manage cybersecurity risks. This function includes defining roles and responsibilities, allocating resources, and ensuring compliance with regulatory requirements.
  
  
• Identify: Identification is the process of determining which assets are most important to protect, such as customer information, financial records, or network infrastructure like company servers. It also involves identifying key threats to those assets, such as cyberattack vectors or physical vulnerabilities.

• Protect: Protection requires implementing safeguards that help secure identified assets from risks. In this stage, the controls might be installing firewalls and antivirus software, training employees on cybersecurity best practices, or putting your servers behind locked doors with CCTV monitoring.

• Detect: Detection promotes a vigilant security posture capable of detecting security incidents as they unfold. The specific controls could be things like monitoring network traffic, analyzing security logs, and setting up alerts for potential security breaches.

• Respond: Response outlines actions to take to contain and mitigate the impact of a security incident. This includes the tools and techniques needed to isolate infected systems, remove malware, and notify affected parties.

• Recover: Recovery focuses on restoring systems to normal working order. This includes specific actions like restoring systems from backups, analyzing the security incident for insight into your own defenses, and making adjustments to be better prepared for the future.

Successful cybersecurity professionals blend highly-specific technical knowledge with strong non-technical skills to collaborate effectively with other members of their organization.


Technical skills

Technical cybersecurity work requires mastery over a few specialized areas. Effective security professionals need to know how to monitor systems to track potential threats, develop programming knowledge for automation, and be aware of system fundamentals to identify vulnerabilities. A technical foundation for cybersecurity typically includes:

• Security information and event management (SIEM) tools: These tools help collect, analyze, and manage security data to detect and respond to potential threats in real time.
  
  
• Programming languages like Structured Query Language (SQL) and Python: Programming knowledge enables analysts to automate tasks, query databases, and develop custom security solutions.
  
  
• Networking fundamentals: Understanding how networks operate allows professionals to identify vulnerabilities and implement effective security measures.
  
  
• Linux: Many servers and security tools run on Linux, so familiarity with this operating system is often critical for managing and securing systems.
  
  
• General awareness of the threat landscape: Staying informed about emerging threats helps professionals anticipate risks and adapt their defenses accordingly.
  
  
• Cloud security: Knowledge of how to secure data and systems in cloud environments, as many modern organizations rely on cloud computing.
  
  
• Incident investigation and forensics: The ability to analyze data, reconstruct events, and collect digital evidence after a security breach to determine what happened and contain the damage.
  
  
• Network analysis tools: Familiarity with tools like packet sniffers to capture and analyze network traffic for malicious activity or anomalies.

Transferable skills

Beyond technical expertise, effective security professionals also need well-developed soft skills. For example, clear communication helps translate complex concepts for both technical and non-technical audiences. Other soft skills for a cybersecurity role include:

• Problem-solving: The ability to think critically and creatively is key for addressing unexpected challenges and mitigating security incidents.
  
  
• Collaboration: Working effectively with team members across departments helps align security measures with organizational goals.
  
  
• Analysis: Strong analytical skills are necessary for interpreting data, identifying patterns, and making informed decisions to improve security strategies.
  
  
• Continuous learning: The cybersecurity landscape is constantly evolving. A professional must be willing to learn new technologies, tools, and threat tactics to stay ahead of attackers.
  
  
• Attention to detail: Even the smallest detail can be a sign of a major security issue. Being meticulous in analyzing logs, alerts, and reports is crucial for spotting anomalies and preventing incidents.
  
  
• Patience and resilience: Cybersecurity work can be stressful and complex. Professionals need to be patient during investigations and resilient when facing setbacks or navigating difficult challenges.