Digital Defense Essentials

Cyber security has become increasingly important because modern society depends heavily on digital and Internet-connected technologies. Today, cars, banks, hospitals, industries, businesses and governments use computers, networks and connected devices for daily operations. Modern cars, for example, can receive software updates through the Internet. Although this provides benefits, it also creates risks because hackers may attempt to gain unauthorized access to connected systems. A cyber attack is therefore no longer limited to stealing data; it can potentially disrupt physical systems and even threaten human safety. The Internet of Things (IoT) has increased these risks. IoT refers to physical devices with processing capabilities that can connect to networks or the Internet. For example, a temperature sensor in a refinery can collect and transmit information to a control system. If an attacker manipulates the sensor or its data, the control system may receive incorrect information and make an inappropriate decision. Thus, digital attacks can sometimes produce physical consequences. Technologies such as Manufacturing 4.0 provide benefits such as automation, efficiency and better monitoring, but they also increase the need for strong cyber security. Modern organizations are highly dependent on digital systems such as ERP systems, databases, networks and Internet connectivity. If these systems stop functioning because of a cyber attack, organizations may be unable to perform normal operations. Cyber security therefore affects individuals, organizations, society and governments. Individuals may face threats such as identity theft, bank-account attacks and cybercrime. Organizations may face ransomware, data breaches and system disruption. Governments must protect their own systems and citizen data while also creating laws, policies and regulations to promote security and privacy. An important concept is that technology has three roles in cyber security. First, technology can be a **source of threat**, because computers and networks can be used to launch attacks. Second, technology is an **asset that must be protected**, such as servers, databases, computers and industrial systems. Third, technology can be used as a **defense mechanism**, through tools such as firewalls, encryption, authentication and intrusion-detection systems. Therefore, technology can be understood as a threat, an asset and a defense. Security generally means being in a state of safety or protection from threats. For individuals, important assets include life, property and personal information. For organizations, assets include buildings, equipment, employees, information and computer systems. A security gate provides a simple example: authorized people should be allowed to enter, while unauthorized people should be denied access. This illustrates the basic purpose of security—allowing authorized access and preventing unauthorized access. Information security and cyber security are closely related but have different scopes. Information security mainly focuses on protecting information and the systems that store, process and transmit it. Cyber security has a broader scope and concerns security in the connected digital world. It can include information, systems, networks, connected devices, infrastructure and users. Thus, information security can be considered an important part of the broader field of cyber security. The *CIA Triad* is a fundamental concept of information security. CIA stands for **Confidentiality, Integrity and Availability**. Confidentiality means that information should be accessible only to authorized people. Integrity means that information should remain accurate and should not be improperly changed. Availability means that authorized users should be able to access information and systems when required. Encryption is one technology that can help protect confidentiality. Cyber security is not only a technical problem; it is also a management, governance and regulatory problem. Organizations require technology such as firewalls and encryption, but they also need policies, procedures, trained employees, risk management and proper governance. Governments also create laws and regulations concerning cyber security and privacy. *GRC (Governance, Risk and Compliance)* provides a framework for managing these responsibilities. *Risk management* is mainly proactive: it identifies what could go wrong and takes measures to prevent or reduce the impact of risks. *Contingency planning* is mainly concerned with what to do when something goes wrong despite preventive measures. In simple terms, risk management focuses on prevention, while contingency planning focuses on response and recovery.