Cybersecurity Fundamentals

Learn to describe the modern cybersecurity threat landscape and the four actor categories that populate it. By the end of this lesson you will be able to name nation-state, criminal, insider, and hacktivist actors, identify each one's primary motivation and operational signature, classify a described incident vignette as the work of a specific actor category, and compare today's landscape to the 2015 baseline on the dimensions that shape every control decision that follows.

Learn the two foundational models every security practitioner shares — the CIA triad (Confidentiality, Integrity, Availability) and the AAA model (Authentication, Authorization, Accounting + non-repudiation as the practical fourth). By the end of this lesson you will be able to define each property, classify a given incident along both axes, and explain why maximizing all three CIA properties simultaneously is always a tradeoff rather than a technical gap.

Learn how security practitioners reason about risk and keep it visible to the business. By the end of this lesson you will be able to explain the threat × vulnerability × impact model, compare qualitative and quantitative risk analysis, classify a given risk treatment choice as Mitigate, Transfer, Avoid, or Accept, and name the mandatory fields of a usable risk-register entry.

Learn the layered-controls model that modern security programs are built around and the industry-standard framework for talking about adversary behavior. By the end of this lesson you will be able to describe defense in depth across people, process, and technology layers, walk the Lockheed Martin kill chain stage by stage, map an attacker action to the MITRE ATT&CK tactic and technique it exercises, and explain why detection at an earlier kill-chain stage beats detection at a later one.

Learn the networking primitives security work depends on. By the end of this lesson you will be able to identify the OSI layer at which a given security control operates, explain the TCP three-way handshake and distinguish TCP from UDP, describe why DNS logs are a disproportionately valuable detection surface, and compare a flat network to a segmented one with Zero Trust as the modern architectural response.

Learn the operating-system internals that security work depends on, in both the Windows and Linux worlds. By the end of this lesson you will be able to identify the five OS primitives every practitioner reads, match a described attacker behavior to the specific Windows Event ID or Linux auditd rule key that would surface it, and compare equivalent event sources between Windows and Linux.

Learn the cryptographic primitives security practitioners rely on every day. By the end of this lesson you will be able to distinguish symmetric from asymmetric encryption and name correct use cases for each, explain what cryptographic hashing does and does not guarantee, describe a digital-signature workflow end-to-end, and walk through the TLS handshake stage by stage. The hands-on OpenSSL lab that follows this lesson gives you commands that produce every one of these artifacts.

Learn the taxonomy security practitioners use to classify every control they design, inherit, or audit — administrative, technical, and physical, each operating in a preventive, detective, or corrective role. By the end of this lesson you will be able to classify a given Beacon Harbor control along both axes, name the taxonomy's blind spots, and describe how the taxonomy maps to the audit frameworks (SOC 2, ISO 27001, NIST CSF) that structure Beacon Harbor's compliance program.