Cyber security foundations.

The core ideas

Cyber security protects information and the systems that hold it. Its goals are usually summed up as three properties, often called the CIA triad:

• Confidentiality: only the right people can see the information.
• Integrity: the information is accurate and has not been changed without permission.
• Availability: the information and systems work when people need them.

Security work is about risk, and three words are used carefully:

• A threat is something that could cause harm, such as a criminal group or a careless mistake.
• A vulnerability is a weakness a threat could use, such as an unpatched server or a reused password.
• Risk combines how likely the harm is with how bad it would be.

No organisation can remove every risk, so the real work is choosing which risks to reduce first.

Security is not only about technology. Many successful attacks depend on people: a convincing fake message, a reused password or a payment approved in a hurry. Good security combines technology, clear processes and trained staff.

The attacks that happen most

Most organisations face the same few attacks again and again:

• Phishing: messages that trick people into clicking a link, opening a file or giving away a password. It arrives by email, by SMS (smishing) and by phone call (vishing).
• Stolen and reused passwords: attackers take passwords leaked from one website and try them on many others. This is called credential stuffing.
• Ransomware: malicious software that locks (encrypts) an organisation's data and demands payment. Attackers often steal a copy first and threaten to publish it.
• Business email compromise: an attacker takes over, or pretends to be, a trusted email account in order to redirect payments. A common example is a "supplier" email announcing new bank details.
• SIM swap: a criminal persuades a mobile operator to move a victim's phone number to a new SIM card, then receives the victim's one-time passcodes. This matters wherever phones approve payments, including mobile money.
• Unpatched systems: known weaknesses in software that has not been updated.
• Insider threats: staff or contractors who misuse their access, on purpose or by mistake.

Attacks can also arrive through suppliers. If attackers break into a software update or an IT service provider, they may reach every customer of that supplier at once.

Controls that stop most attacks

Many real attacks succeed because a basic control was missing. The basics are:

• Multi-factor authentication (MFA), meaning a second proof of identity besides the password, on email, remote access and administrator accounts. Security keys and passkeys resist phishing. Codes sent by SMS are weaker, because a SIM swap can intercept them.
• Patching: install security updates quickly, starting with systems that can be reached from the internet.
• Least privilege: give each person and system only the access they need, and review it regularly.
• Backups that ransomware cannot reach. A common rule is 3-2-1: three copies of important data, on two different kinds of storage, with one copy kept off site. Keep at least one copy offline or unchangeable too, and test that restoring actually works.
• Logging and monitoring, so unusual activity is noticed and can be investigated later.
• An asset inventory: a list of all your devices, systems and software. Anything missing from the list is probably not being patched or watched.
• Encryption of sensitive data, both when it is stored and when it is sent.
• Awareness training, so staff recognise phishing and report it quickly, without fear of blame.

An approach that ties these together is zero trust: no user or device is trusted just because it is inside the office network. Every request is checked: who is asking, from which device, and whether they need that access.

Frameworks and Kenyan law

A framework gives an organisation a structure for its security work and a way to measure progress. Two are widely used:

• The NIST Cybersecurity Framework (CSF), published by the US National Institute of Standards and Technology. Version 2.0, released in February 2024, groups security outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover.
• ISO/IEC 27001 (current edition 2022), the international standard for an information security management system. Organisations can be independently certified against it.

In Kenya, several laws apply:

• The Computer Misuse and Cybercrimes Act, 2018 (amended in 2025) sets out cybercrime offences, such as unauthorised access to computer systems.
• The Data Protection Act, 2019 requires appropriate security for personal data. Section 43 covers a breach that creates a real risk of harm to the people affected. The organisation must notify the Data Commissioner within 72 hours of becoming aware of it, and a later notice must give reasons for the delay. The affected people must also be told in writing within a reasonably practical period.
• Sector regulators, such as the Central Bank of Kenya for banks and payment service providers, also issue their own cyber security requirements.

The National KE-CIRT/CC, Kenya's national computer incident response team, is run by the Communications Authority of Kenya. It coordinates the response to cyber incidents nationally, receives incident reports and publishes security advisories.

Responding to an incident

Sooner or later, every organisation has a security incident. The difference is whether it is prepared. A widely used way to describe the response comes from NIST's long-standing incident-handling guide (SP 800-61). It is often summarised in these stages:

• Prepare: a written plan, named roles, contact lists, and backups and logs that you know work.
• Detect and analyse: confirm what happened, which systems and data are affected, and how serious it is.
• Contain: stop the spread, for example by disconnecting affected computers from the network or disabling a compromised account.
• Eradicate and recover: remove the cause, restore from clean backups and watch closely for signs that the attacker has returned.
• Learn: review what happened and fix the weaknesses that allowed it.

NIST's 2025 revision of that guide links these activities to the six CSF functions from the previous lesson, but the stages above remain a useful plan.

If you are not on the security team, your job is simple: report anything suspicious at once through your organisation's channel, even if you think you caused it. Early reports limit damage.

Throughout an incident, preserve evidence such as logs and affected files, keep a timeline of decisions, and meet legal duties such as breach notification. Paying a ransom does not guarantee that data will be returned or deleted. It can also create legal problems, for example if the attackers are under sanctions, so take legal advice first.

Automation can speed up detection and containment. But actions with a large impact, such as shutting down a live business system or locking out a senior user, should follow an approved plan, with a person's approval where the plan requires it.

Your certificate of completion

Enter your name as you want it to appear, then save the certificate as a PDF. In the print window, choose Save as PDF. A certificate is issued once per completion of the course.

Saolix does not record who takes this course, so it cannot verify these certificates. The certificate confirms completion of a free self-paced course and is not an accredited qualification.