Die Druckversion wird nicht mehr unterstützt und kann Darstellungsfehler aufweisen. Bitte aktualisiere deine Browser-Lesezeichen und verwende stattdessen die Standard-Druckfunktion des Browsers.

Cybersecurity Fundamentals

Introduction

Cybersecurity Fundamentals introduces the principles, technologies, human factors, and governance practices used to protect digital systems and information. The course is designed for university students in computing, business, engineering, social science, and other fields that depend on trustworthy digital services. You will learn to think about cybersecurity as a form of risk management rather than as a collection of isolated technical tricks.

Cybersecurity aims to reduce the likelihood and impact of unwanted events affecting information, systems, people, and organizations. Effective security combines technical controls with clear processes, usable policies, trained people, and responsible leadership. No single control can eliminate all risk, so mature programs use layered defenses, continuous monitoring, and preparation for recovery.

By the end of this aiMOOC, you should be able to explain core security concepts, recognize common attack patterns, select appropriate controls, reason about trade-offs, interpret a basic risk scenario, and connect technical decisions to governance, ethics, privacy, and organizational resilience.

Learning Goals

You should be able to:

Information security: Explain confidentiality, integrity, and availability and apply them to realistic university and workplace systems.
Threat modeling: Distinguish assets, threats, vulnerabilities, controls, incidents, likelihood, and impact.
Identity and access management: Explain authentication, authorization, least privilege, multifactor authentication, and passkeys.
Network security: Describe segmentation, firewalls, encrypted transport, secure configuration, and monitoring.
Cryptography: Distinguish symmetric encryption, public-key cryptography, hashing, and digital signatures.
Malware: Recognize major threat categories such as phishing, ransomware, credential attacks, and software supply-chain risk.
Incident response: Outline detection, triage, containment, eradication, recovery, and lessons learned.
Cyber risk management: Relate technical safeguards to the NIST Cybersecurity Framework and broader organizational risk.

Core Security Principles

The CIA Triad

A widely used foundation for information security is the CIA triad: confidentiality, integrity, and availability.

Confidentiality means preventing unauthorized disclosure of information. Access control, encryption, and data minimization can support confidentiality. Integrity means protecting information and systems against unauthorized or improper alteration. Hashes, digital signatures, access controls, validation, and change management can support integrity. Availability means ensuring that authorized users can access needed systems and data when required. Redundancy, resilient architecture, tested backups, capacity planning, and incident response can support availability.

These goals can conflict. For example, an extremely restrictive access policy may improve confidentiality while making a service harder to use. Cybersecurity decisions therefore require explicit trade-offs informed by mission needs and risk.

Assets, Threats, Vulnerabilities, Controls, and Risk

An asset is something of value, such as research data, a student information system, credentials, intellectual property, a laboratory device, or an organization's reputation. A threat is a circumstance or actor that could cause harm. A vulnerability is a weakness that can be exploited or triggered. A control or safeguard reduces likelihood, impact, or both. An incident is an event that actually or potentially jeopardizes confidentiality, integrity, availability, or policy objectives.

A simplified model treats risk as a combination of likelihood and impact. Real risk assessment is more nuanced: uncertainty, dependencies, adversary capability, exposure, legal obligations, safety consequences, and recovery capacity may all matter. The purpose of a risk model is not to predict the future perfectly; it is to support defensible priorities.

Security Principles for Design

Least privilege gives users, applications, and services only the access they need. Separation of duties divides critical responsibilities so that one person or component cannot complete a sensitive process alone. Secure defaults start from the least permissive reasonable configuration. Defense in depth uses multiple independent or complementary safeguards so that one failure does not automatically become a catastrophic compromise.

Zero trust is an architectural approach that avoids treating network location alone as proof of trust. Access decisions should consider identity, device state, context, policy, and resource sensitivity, with continuous verification where appropriate.

Common Threats and Attack Patterns

Social Engineering and Phishing

Phishing uses deception to persuade people to reveal information, approve access, open malicious content, or visit fraudulent services. Social engineering can exploit urgency, authority, curiosity, fear, or familiarity. Technical defenses such as filtering and phishing-resistant authentication help, but secure processes are equally important. For high-value actions, independent verification through a trusted channel can reduce the risk of impersonation.

When evaluating a suspicious message, examine the sender context, destination of links, unexpected attachments, unusual requests, urgency, and whether the request fits normal procedures. Do not test suspicious links or files on a production device. Use approved reporting channels.

Malware, Ransomware, and Credential Attacks

Malware is software intentionally designed to cause harm or perform unauthorized actions. Categories include ransomware, spyware, trojans, worms, and destructive malware. Ransomware commonly attempts to deny access to data or systems, often through encryption, while demanding payment. Modern incidents may also involve data theft or extortion.

Credential attacks target passwords, session tokens, API keys, or other authentication material. Defenses include unique credentials, secure storage, multifactor authentication, passkeys where supported, rate limiting, monitoring, and rapid revocation after suspected compromise.

Misconfiguration, Vulnerable Software, and Supply Chains

Many incidents begin with systems that are exposed unnecessarily, configured insecurely, or left unpatched. Vulnerability management therefore includes asset inventory, secure configuration, patching, prioritization, verification, and exception handling. Software dependencies and third-party services add supply-chain risk: your security can depend on code, vendors, infrastructure, and identities outside your direct control.

Secure software development incorporates security throughout requirements, design, implementation, testing, deployment, and maintenance. Reviews should consider authentication, authorization, input handling, secret management, dependency risk, logging, error handling, and secure update mechanisms. Security testing must be authorized and scoped.

Identity and Access Management

Authentication asks who or what is attempting access. Authorization determines what an authenticated identity may do. Accounting or audit logging records relevant activity so that actions can be reviewed.

Passwords remain common, but password reuse creates risk because one breached service can endanger another. A password manager can generate and store unique credentials. Multifactor authentication requires independent factors, such as something you know and something you possess. Some methods are more resistant to phishing than others; cryptographic passkeys and security keys can provide stronger protection than manually entered one-time codes in many contexts.

Access control should follow least privilege and should be reviewed when roles change. Privileged accounts deserve additional protection, monitoring, and separation from routine work.

Network and Infrastructure Security

Networks connect endpoints, servers, cloud services, applications, and users. Security architecture should reduce unnecessary exposure and limit how far an attacker can move after a compromise. Network segmentation separates systems by trust, function, or sensitivity. Firewalls enforce traffic rules at network or host boundaries. Secure remote access, hardened configurations, intrusion detection, endpoint protection, and centralized logging can add further layers.

Encrypted protocols such as TLS protect data in transit against passive observation and can authenticate communicating parties. DNS security, certificate validation, time synchronization, and secure management interfaces also matter because infrastructure services form part of the trust chain.

A firewall is not a complete security strategy. If stolen credentials allow a legitimate-looking session, or if a vulnerable application is exposed through an allowed port, other controls must detect or limit the problem.

Cryptography Basics

Cryptography provides mathematical tools for confidentiality, integrity, authentication, and related security goals. Symmetric encryption uses a shared secret key and is efficient for protecting large amounts of data. Asymmetric cryptography uses related public and private keys and can support encryption, key establishment, and digital signatures. A cryptographic hash function maps data to a fixed-length digest and is designed so that meaningful changes to the input are detectable. A digital signature can provide evidence that data was signed by the holder of a private key and that the signed content has not been altered.

Cryptography is only as strong as its implementation and key management. Secure systems need appropriate algorithms, protected private keys, safe random-number generation, certificate validation, key rotation or replacement processes, and plans for key compromise. Avoid designing your own cryptographic algorithm for real security use.

Detection, Incident Response, and Recovery

Security monitoring aims to identify suspicious behavior, policy violations, and system failures early enough to reduce harm. Useful evidence can include authentication events, endpoint telemetry, application logs, network events, cloud audit records, and alerts from security tools. Logging should be purposeful: collecting everything without retention rules, time synchronization, access controls, or analysis can create cost without improving security.

A practical incident-response lifecycle includes preparation, detection and analysis, containment, eradication, recovery, and post-incident learning. Teams should preserve evidence where appropriate, communicate through established channels, document decisions, and coordinate technical, legal, privacy, leadership, and communications responsibilities.

Backups support recovery only when they are protected from the same failure or attacker and when restoration is tested. Recovery plans should define priorities, dependencies, acceptable downtime, and how to verify that restored systems are trustworthy before normal operations resume.

Cybersecurity Governance and Risk Management

Cybersecurity is an organizational responsibility. Leaders decide priorities, risk tolerances, resources, accountabilities, and how security integrates with business or academic missions. Policies translate these decisions into expectations, while standards and procedures make them actionable.

The NIST Cybersecurity Framework 2.0 organizes cybersecurity outcomes into six high-level Functions: Govern, Identify, Protect, Detect, Respond, and Recover. The Functions are intended to provide a common language for managing cybersecurity risk rather than a single mandatory implementation recipe.

A university might use Govern to define responsibility and policy, Identify to understand critical systems and risks, Protect to implement safeguards, Detect to discover suspicious activity, Respond to manage an incident, and Recover to restore services and improve resilience.

Privacy, Ethics, Law, and Responsible Practice

Security and privacy overlap but are not identical. A system can be secure against unauthorized access while still collecting more personal data than necessary. Good design considers purpose limitation, data minimization, transparency, retention, access, and applicable legal or institutional requirements.

Cybersecurity work must be authorized. Do not scan, probe, exploit, intercept, or access systems, accounts, or data without explicit permission and an appropriate scope. In university laboratories, use instructor-provided environments, deliberately vulnerable training systems, or your own isolated test systems. Professional competence includes knowing the technical boundary, the legal boundary, and the ethical boundary.

Reliable Starting Points

For authoritative and openly accessible guidance, consult:

NIST Cybersecurity Framework: Framework resources for understanding and managing cybersecurity risk.
NIST Cybersecurity Framework 2.0: The official CSF 2.0 publication page.
NIST Digital Identity Guidelines: Current guidance on authenticators, passwords, multifactor authentication, and phishing resistance.
CISA Cyber Threats and Advisories: Defensive information about common cyber threats and protective actions.
OWASP Top 10: A widely used awareness resource for major web application security risks.

Interactive Tasks

Quiz: Test Your Knowledge

Diesen aiMOOC als Battle spielen

Which CIA principle focuses on ensuring that authorized users can access systems and data when needed? (Availability) (!Confidentiality) (!Anonymity) (!Obfuscation)

Which term describes a weakness that could be exploited or triggered? (Vulnerability) (!Asset) (!Policy) (!Recovery)

Which principle gives users and services only the access needed for their tasks? (Least privilege) (!Open access) (!Shared control) (!Universal trust)

What is a primary purpose of a firewall? (Filter network traffic) (!Encrypt every file) (!Create user passwords) (!Replace backups)

Which cryptographic mechanism uses a private key to create verifiable evidence of origin and integrity? (Digital signature) (!Password manager) (!Network segment) (!Backup archive)

What does multifactor authentication require? (More than one independent factor) (!One long username) (!One shared password) (!One network address)

What best describes phishing? (Deception used to trick users) (!Routine software updating) (!Network traffic filtering) (!Data backup testing)

Which practice most directly shows that backups can support recovery? (Test restoration) (!Hide filenames) (!Reuse passwords) (!Disable logging)

Which Function is part of NIST Cybersecurity Framework 2.0 alongside Identify Protect Detect Respond and Recover? (Govern) (!Encrypt) (!Purchase) (!Delete)

Which incident response activity focuses on limiting the spread or damage of an active incident? (Containment) (!Marketing) (!Procurement) (!Archiving)

Memory Game

Asset	Something of value that needs protection
Threat	A circumstance or actor that could cause harm
Vulnerability	A weakness that can be exploited or triggered
Control	A safeguard that reduces cybersecurity risk
Risk	The possibility and consequence of harm under uncertainty
Incident	An event that jeopardizes security objectives or policy

Drag and Drop

Match the correct terms.	Cybersecurity concept
Password manager	Generates and stores unique credentials
Multifactor authentication	Requires independent types of proof
Network segmentation	Separates systems to limit unwanted movement
Encryption	Protects data using cryptographic transformation
Logging	Records events for detection and investigation

Crossword Puzzle

Firewall	What security control filters network traffic according to rules?
Phishing	What deception technique often uses fraudulent messages or websites?
Encryption	What process transforms readable data using a cryptographic key?
Ransomware	What malware category commonly denies access to data and demands payment?
Integrity	Which CIA principle concerns unauthorized or improper alteration?
Recovery	What process restores systems and operations after disruption?

LearningApps

Cloze Text

Open-Ended Tasks

Easy

Security vocabulary map: Create a one-page concept map that connects asset, threat, vulnerability, control, risk, and incident with your own university-related examples.
Phishing analysis: Examine several instructor-provided mock messages, mark signs of possible phishing, and write a short explanation of how you would verify each request safely.
Password hygiene: Produce an illustrated guide for students that explains unique passwords, password managers, multifactor authentication, and passkeys without revealing any real credentials.
Campus cybersecurity interview: Interview an authorized university IT or security staff member about common defensive challenges and summarize three lessons in a short article.

Standard

Network defense diagram: Design a labeled network diagram for a fictional university laboratory and explain where you would use segmentation, firewalls, encrypted connections, and logging.
Backup recovery experiment: In an isolated test folder, create a small backup, simulate accidental file loss, restore the data, and document what made the recovery reliable or unreliable.
Incident response tabletop: Run a tabletop exercise for a fictional ransomware alert, assign team roles, record decisions, and create a timeline from detection through recovery.
Cybersecurity explainer video: Produce a three-minute educational video that explains one security principle, includes a realistic example, and distinguishes prevention from detection and recovery.

Advanced

Risk register: Build a risk register for a fictional university service, justify likelihood and impact ratings, propose controls, and explain the residual risk after treatment.
Secure software review: Review instructor-provided or deliberately vulnerable sample code in an authorized lab, identify design or implementation weaknesses, and propose defensive fixes without targeting real systems.
NIST CSF profile: Create a current-state and target-state profile for a fictional department using the six NIST CSF 2.0 Functions and justify your highest priorities.
Cybersecurity policy critique: Compare a public university or organizational security policy with recognized guidance, identify strengths and gaps, and present a reasoned revision proposal.

Learning Assessment

Threat-to-control reasoning: Given a case in which a research account is phished, identify assets, vulnerabilities, likely impacts, and at least four controls, then explain which controls reduce likelihood and which reduce impact.
Architecture trade-off: Compare two proposed network designs for a student laboratory and defend the one that better balances least privilege, usability, resilience, and monitoring.
Cryptography selection: For data at rest, data in transit, password verification, and software authenticity, choose appropriate cryptographic mechanisms and justify why each fits the security goal.
Incident response decision: Analyze a scenario with suspicious logins and unavailable files, prioritize the first response actions, and explain what evidence should be preserved before major changes are made.
Governance transfer: Map a fictional campus service to the six NIST CSF 2.0 Functions and explain how technical actions connect to leadership, policy, and risk ownership.
Ethical boundary analysis: Evaluate a proposed security test and distinguish actions that are permitted in an authorized lab from actions that would require additional permission, legal review, or a narrower scope.

Evidence of Learning

Important evidence of learning includes:

Knowledge: Accurate explanations of confidentiality, integrity, availability, threats, vulnerabilities, risk, identity, network security, cryptography, incident response, and governance.
Reasoning: The ability to connect a threat scenario to assets, weaknesses, controls, likely impact, and residual risk.
Technical communication: Clear diagrams, reports, risk registers, incident timelines, and explanations that can be understood by both technical and nontechnical audiences.
Practical products: A threat model, network defense design, tested recovery procedure, incident-response tabletop record, and NIST CSF profile created in safe or fictional environments.
Professional judgment: Evidence that you can balance security, usability, privacy, cost, resilience, and mission needs.
Transfer: The ability to apply the same principles to unfamiliar systems such as cloud services, research platforms, mobile devices, industrial systems, or AI-enabled applications.
Ethical practice: Consistent use of authorization, scope, data minimization, and responsible disclosure or reporting channels when working with security issues.

OERs on the Topic

The English Wikipedia article on computer security provides a broad open reference that you can use to review terminology and follow links to related topics.

You can deepen your study with the open guidance in the NIST Cybersecurity Framework, Computer security, Information security, Network security, Cryptography, Identity management, Malware, Phishing, and Incident management learning areas.