Securing a system does not mean making it invulnerable. It means reducing risk, detecting quickly, limiting the damage and recovering.
2.1What securing means: the CIA triad
All of cybersecurity comes down to three objectives: Confidentiality (only authorised people access the information), Integrity (the information is not altered) and Availability (systems and data remain accessible when needed).
Every attack targets at least one of the three: espionage hits confidentiality, tampering hits integrity, ransomware and denial of service hit availability. To these are added authentication and traceability.
2.2The fundamental building blocks
- Cryptography: symmetric encryption, asymmetric encryption, signatures and hash functions protect data and guarantee its integrity.
- Authentication: a password alone is fragile; MFA adds a second factor and passkeys reduce the risk of phishing.
- Least privilege: every user and every program receives only the rights strictly needed.
- Defence in depth: several independent layers prevent a single failure from becoming catastrophic.
2.3Anatomy of an attack: the kill chain
An intrusion often follows the same steps, detailed in the MITRE ATT&CK framework: reconnaissance, initial access, privilege escalation, lateral movement, then the final action: exfiltration, encryption, sabotage or discreet persistence.
- Reconnaissance: social networks, past leaks, technical scans.
- Initial access: phishing, an unpatched flaw, a stolen credential.
- Lateral movement: the attacker moves through the network towards critical assets.
- Final action: data theft, ransomware, sabotage or long-term espionage.
2.4The human factor
Most compromises involve a human: a click on an attachment, a reused password, a fake call from "support". Social engineering remains attackers' most profitable weapon, and generative AI makes it more convincing: flawless emails, cloned voices, deepfake video calls.
2.5From the castle to zero trust
The historical model (a sealed perimeter, trust on the inside) no longer holds with the cloud, remote work and the software supply chain. The dominant paradigm is zero trust: never trust by default, always verify.
Its corollary is assume breach: start from the principle that the attacker may already be inside, and design the system to limit the damage. Behind these doctrines lies a structural asymmetry: the defender must succeed everywhere; the attacker only needs to succeed once.
Key takeaway
Cybersecurity is not a product but risk management: identify what has value, reduce the attack surface, detect quickly, limit the damage, know how to recover. And the chain almost always breaks in the same place: the human.
Sources
MITRE ATT&CK (attack.mitre.org); ANSSI IT hygiene guides (cyber.gouv.fr); NIST zero trust recommendations.
Finished this module?
Your progress is saved on this device.