What is Cybersecurity?¶
What you'll be able to do in this chapter
- Define cybersecurity in terms of what it protects (the CIA triad) rather than the tools used.
- Use the core vocabulary (asset, threat, vulnerability, impact) correctly.
- Explain why factory (OT) systems reorder the usual security priorities.
A question that sounds easy¶
Ask ten people what cybersecurity is and you will get ten lists of things: firewalls, passwords, hackers, antivirus, the cloud. These are common parts of cybersecurity, but they describe tools and threats rather than its purpose.
Here is a sharper way in. Scaldimet's production line in France runs on factory-control systems. Suppose someone changes a single setting on one of those systems (say, the tolerance a machine uses when it stamps a metal bracket) and the change goes unnoticed. No data is stolen. Nothing is "hacked" in the dramatic sense. But thousands of parts ship to a car manufacturer slightly out of specification. Was that a cybersecurity failure?
To answer, you need to know what cybersecurity is actually protecting. It is not protecting "the computers." It is protecting three properties of information and systems. Once you see those three, the bracket question answers itself.
The three properties: the CIA triad¶
Cybersecurity exists to preserve three properties of information and the systems that handle it. They are known as the CIA triad: nothing to do with the agency; it is just the initials.
Technical explainer (read & discuss, don't build): the CIA triad
Confidentiality: information is seen only by those allowed to see it. Broken when: customer designs leak, an employee reads payroll they shouldn't, a database is copied by an attacker.
Integrity: information and systems are accurate and have not been changed without authorisation. Broken when: a machine setting is altered, financial figures are tampered with, an email instruction is forged.
Availability: information and systems are usable when needed. Broken when: ransomware locks the files, a production line's control system goes down, a server crashes during a shift.
A clean way to remember it: C is "who can see it", I is "can I trust it", A is "can I use it". Almost any security incident can be described as a loss of one or more of these. You don't need to defend the triad technically (you need to be able to say, for any given system, which of the three matters most and why). That judgement is pure GRC.
Now the bracket question is easy. Nobody saw anything they shouldn't (confidentiality is fine). Nothing was unavailable (the line kept running). But the integrity of the machine's settings was lost (the system was doing the wrong thing while appearing to work normally). Yes: that is a cybersecurity failure, and a serious one, because the damage (out-of-spec parts reaching a customer) is exactly the kind of thing that ends supply contracts.
So a working definition:
Cybersecurity is the practice of protecting the confidentiality, integrity and availability of information and the systems that handle it, against accidental or deliberate harm.
Note what this definition does not mention: hackers, firewalls, or computers specifically. Those are common threats and common tools (but the purpose is the three properties). Keeping the purpose clear helps put the tools and threats into context.
The vocabulary you will use everywhere¶
Four words appear in nearly every later Lesson. People use them loosely in conversation; you cannot afford to. Get these precise now and the rest of the course is easier.
| Term | Plain meaning | Scaldimet example |
|---|---|---|
| Asset | Something of value worth protecting | The Manufacturing Execution System at Site Alpha |
| Threat | Something that could cause harm | A ransomware group; a careless contractor; a flood |
| Vulnerability | A weakness that a threat could use | Unsupported software on Beta's factory systems |
| Impact | The harm done if it goes wrong | Production stops; the OEM applies penalties |
The relationship between them is the basis for risk analysis: a threat exploits a vulnerability in an asset, producing an impact. Ransomware (threat) exploiting unsupported software (vulnerability) on the French factory's control systems (asset) could stop the line (impact). Remove any link in that chain and the harm doesn't happen (which is exactly why there are several different ways to treat a risk).
Why a factory changes the answer¶
In a normal office, the usual priority order is C, I, A: confidentiality tends to come first. Leaking customer data or financial records is often the primary concern. Availability matters, but if email is down for an hour, the company survives.
A factory inverts this. On Scaldimet's production systems, the priority order is closer to A, I, C: availability and integrity come first. The distinction matters because these systems control physical machinery that shape metal. If a control system is unavailable, the line stops and parts don't ship (and Scaldimet's customer, whose own factory is waiting, applies penalties). If a control system's integrity is lost, the machines make the wrong thing, or behave unsafely. Confidentiality still matters, but it is rarely the first worry on the factory floor.
This is the single most important thing to carry out of this Lesson: the same triad, weighted differently depending on the system. A CISO who treats the French factory like an office (obsessing over data leaks while ignoring whether the line can be stopped) is protecting the wrong property.
Technical explainer (read & discuss, don't build): IT vs OT
You will hear two abbreviations constantly.
IT (Information Technology): the ordinary computing world: email, ERP, databases, laptops. Generally prioritises confidentiality, and can usually be patched and rebooted freely.
OT (Operational Technology): the systems that monitor and control physical equipment: the factory-control systems running Scaldimet's machines, the sensors watching them. Generally prioritises availability and safety. OT often cannot simply be patched or rebooted, because stopping it stops production (and some of Scaldimet's OT in France is so old it can no longer be updated at all).
You are not expected to operate OT. You are expected to understand that it follows different rules from IT, and to stop treating "security" as one uniform thing across both. This IT/OT distinction is used throughout the case study.
Application: which property, which system?¶
Below are three things that could happen at Scaldimet. For each, write down (a) which CIA property is primarily lost, and (b) whether you would expect the priority to differ between an office system at Alpha and a factory system at Beta. Decide before reading the debrief.
- An attacker copies the engineering drawings for a customer's new transmission housing.
- Ransomware encrypts the control system supervising a production cell in France, and the line halts.
- A maintenance contractor quietly changes a calibration value on a stamping machine; parts start drifting out of tolerance.
Debrief. (1) is confidentiality: and it is most painful for the office/engineering side, where the valuable designs live. (2) is availability: and it has a major business impact because it affects OT, where a stopped line means missed deliveries and penalties. (3) is integrity: and it is the most difficult of the three to detect, because nothing looks broken; the system continues operating while doing the wrong thing. Notice that all three are "cybersecurity", yet they threaten different properties and land hardest in different places. A one-size security approach would over-protect one and miss another.
Key takeaway
Cybersecurity protects three properties (confidentiality, integrity, availability) of information and the systems handling it. Define it by purpose, not by tools. The same triad is weighted differently for different systems: Scaldimet's offices lean towards confidentiality, its factories towards availability and integrity. Knowing which property matters most for which system is a governance judgement, and it is the foundation everything else in this course is built on.