Cybersecurity Fundamentals Cheat Sheet

Updated 2026-07-16

Next Topic: Data Loss Prevention (DLP) Cheat Sheet

🎯Take a practice test on this topic9 practice tests · 273 questions→

🧠Study flashcards on this topic195 cards · spaced repetition→

Cybersecurity is the practice of protecting systems, networks, data, and programs from digital attacks, unauthorized access, and damage. Built on core principles like the CIA triad (Confidentiality, Integrity, Availability), cybersecurity encompasses threat identification, vulnerability management, control implementation, and incident response to maintain organizational resilience. In 2026, with AI-powered attacks, zero-trust architectures, and increasingly sophisticated threats, understanding these fundamentals is no longer optional — it's the baseline for operating securely in a hyper-connected world. Keep in mind that cybersecurity is fundamentally about risk management, not absolute prevention; the goal is to reduce risk to acceptable levels while maintaining business functionality.

What This Cheat Sheet Covers

This topic spans 29 focused tables and 207 indexed concepts, 195 flashcards, 9 practice tests with 273 questions. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: CIA Triad — Core Security PrinciplesTable 2: Security Threat CategoriesTable 3: Social Engineering Attack TypesTable 4: Malware TypesTable 5: Vulnerability and Risk ConceptsTable 6: Security Controls — By TypeTable 7: Security Controls — By FunctionTable 8: Defense-in-Depth LayersTable 9: Authentication Factors and MethodsTable 10: Access Control ModelsTable 11: Cryptography FundamentalsTable 12: Network Security ComponentsTable 13: Cloud Security FundamentalsTable 14: Security Frameworks and StandardsTable 15: Risk Management StrategiesTable 16: Incident Response LifecycleTable 17: Security Monitoring and OperationsTable 18: Threat IntelligenceTable 19: Security Principles and Best PracticesTable 20: Data Classification and HandlingTable 21: Compliance and RegulationsTable 22: Endpoint and Extended Detection TechnologiesTable 23: Backup and Business ContinuityTable 24: Vulnerability and Patch ManagementTable 25: VPN Types and ProtocolsTable 26: Security PoliciesTable 27: Application Security ConceptsTable 28: Red Team, Blue Team, and Purple Team OperationsTable 29: AI-Driven Threats and Defenses

Quick IndexSubscribe to unlock

A jump-to index of every table row in this cheat sheet.

Mind MapSubscribe to unlock

An interactive map of every table and concept in this topic.

Table 1: CIA Triad — Core Security Principles

The CIA triad is the cornerstone of every security program, and every control you deploy ultimately protects one or more of these properties. Two more properties, non-repudiation and authenticity, get added whenever accountability and origin matter. Knowing which property a control actually protects, and where each one fails, is the starting point for reasoning about any security decision.

Principle	Example	Description
Confidentiality	`Encrypt customer PII with AES-256` `Implement access controls (RBAC)`	• Preserves authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information (NIST FIPS 200) • enforced through encryption, access control, and data classification. Encryption at rest does nothing against an already-authorized account, so access control carries equal weight.
Integrity	`Use SHA-256 hash to verify file integrity` `Digital signatures for email`	• Guards against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity (NIST FIPS 200) • delivered by hashing, MACs, and digital signatures, not by encryption. Plain encryption hides data without proving it stayed unchanged.
Availability	`Deploy load balancers and failover systems` `DDoS mitigation (rate limiting)`	• Ensures timely and reliable access to and use of information (NIST FIPS 200) • maintained through redundancy, disaster recovery, and business continuity planning. A DDoS or ransomware outage is a security failure of this property, not just an ops problem. RTO caps how long a resource may stay unavailable, RPO caps how much data you may lose.
Non-repudiation	`Digital signatures on contracts` `Audit logs with timestamps`	• Assurance that an actor cannot later credibly deny an action they performed • needs a signature verifiable as having originated from the specific entity holding the private key, plus logging. A shared secret cannot deliver it, since either party could have produced the evidence. Supports accountability and legal defensibility.
Authenticity	`PKI certificates verify server identity` `DNSSEC validates DNS responses`	• The property of being genuine and able to be verified and trusted, including confidence in the validity of a message originator (NIST SP 800-53 Rev. 5) • delivered through certificates, digital signatures, and trusted channels. It answers "is this really from who it claims?", while non-repudiation adds that the actor cannot deny it afterwards.

Table 2: Security Threat Categories

You cannot defend against what you cannot name. These categories sort the main ways attackers get in, stay in, and cause harm, and the skill worth building is telling them apart: what each one targets, which security property it attacks, and how it differs from the category sitting next to it.

Threat	Example	Description
Phishing	`Email mimics a bank, requests credentials` `Fake login page captures a password`	• Social engineering attack in which an actor poses as a trustworthy colleague, acquaintance, or organization to lure a victim into giving up sensitive information or network access • targets the person, not a software flaw, so a fully patched organization can still be phished.

The rest of this section is part of the full cheat sheet

Social engineering targets the person rather than the software, and almost every modern intrusion involves some form of it. Each technique below is best understood by three questions: who is targeted, which channel carries the lure, and which instinct it exploits (urgency, authority, curiosity, reciprocity or plain politeness). Those three answers are what decide the defence.

Technique	Example	Description
Phishing	`Fake login page harvests O365 credentials` `Mass email: "Your account has been suspended"`	Attacker poses as a trusted entity by email, SMS or social media to trick victims into clicking links, handing over credentials, or running malware. All forms of phishing are electronically delivered social engineering. A padlock on the fake page proves nothing: it marks an encrypted channel, not an honest operator.

The rest of this section is part of the full cheat sheet

Table 4: Malware Types

Each malware family earns its name from how it gets in, how it spreads, and how it hides. Knowing which family you are looking at tells you what will actually contain it, because the move that stops a worm does nothing to a trojan. Real campaigns often chain several of these together in one intrusion.

Type	Example	Description
Virus	`Cascade virus infects .exe program files` `Melissa virus infects Word documents`	• Malicious code that attaches to legitimate files and requires user action to execute • replicates by infecting other files and spreading to other systems.

The rest of this section is part of the full cheat sheet

Table 1: CIA Triad — Core Security Principles

Principle	Example	Description
Confidentiality	`Encrypt customer PII with AES-256` `Implement access controls (RBAC)`	• Preserves authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information (NIST FIPS 200) • enforced through encryption, access control, and data classification. Encryption at rest does nothing against an already-authorized account, so access control carries equal weight.
Integrity	`Use SHA-256 hash to verify file integrity` `Digital signatures for email`	• Guards against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity (NIST FIPS 200) • delivered by hashing, MACs, and digital signatures, not by encryption. Plain encryption hides data without proving it stayed unchanged.
Availability	`Deploy load balancers and failover systems` `DDoS mitigation (rate limiting)`	• Ensures timely and reliable access to and use of information (NIST FIPS 200) • maintained through redundancy, disaster recovery, and business continuity planning. A DDoS or ransomware outage is a security failure of this property, not just an ops problem. RTO caps how long a resource may stay unavailable, RPO caps how much data you may lose.
Non-repudiation	`Digital signatures on contracts` `Audit logs with timestamps`	• Assurance that an actor cannot later credibly deny an action they performed • needs a signature verifiable as having originated from the specific entity holding the private key, plus logging. A shared secret cannot deliver it, since either party could have produced the evidence. Supports accountability and legal defensibility.
Authenticity	`PKI certificates verify server identity` `DNSSEC validates DNS responses`	• The property of being genuine and able to be verified and trusted, including confidence in the validity of a message originator (NIST SP 800-53 Rev. 5) • delivered through certificates, digital signatures, and trusted channels. It answers "is this really from who it claims?", while non-repudiation adds that the actor cannot deny it afterwards.

Table 2: Security Threat Categories

Threat	Example	Description
Phishing	`Email mimics a bank, requests credentials` `Fake login page captures a password`	• Social engineering attack in which an actor poses as a trustworthy colleague, acquaintance, or organization to lure a victim into giving up sensitive information or network access • targets the person, not a software flaw, so a fully patched organization can still be phished.

Table 3: Social Engineering Attack Types

Technique	Example	Description
Phishing	`Fake login page harvests O365 credentials` `Mass email: "Your account has been suspended"`	Attacker poses as a trusted entity by email, SMS or social media to trick victims into clicking links, handing over credentials, or running malware. All forms of phishing are electronically delivered social engineering. A padlock on the fake page proves nothing: it marks an encrypted channel, not an honest operator.

Table 4: Malware Types

Type	Example	Description
Virus	`Cascade virus infects .exe program files` `Melissa virus infects Word documents`	• Malicious code that attaches to legitimate files and requires user action to execute • replicates by infecting other files and spreading to other systems.