UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 1.1 Free with a free account
What Cybersecurity Means and Why Every Organization Needs It
Ethics in Technology · Chapter 1: What Cybersecurity Means and Why Protecting Digital Information Is Everyone's ResponsibilitySection 1.1 · lesson 1 of 11613 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: The Core Ideas Behind Keeping Information Safe from Unauthorized Access →Next lesson: The Core Ideas Behind Keeping Information Safe from Unauthorized Access →
In this lesson
Protect information, access, and the people who depend on them.
- Define cybersecurity, information security, and privacy
- Balance confidentiality, integrity, and availability
- Recognize the 5 working domains
- Assign responsibility across the organization
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,625 words). Read along, or search it.
Chapter 1
What Cybersecurity Means
Cybersecurity protects information, and the ability to use it, from digital harm. That harm includes theft, unauthorized viewing, damage, and losing access when information is needed. Devices matter because they hold information. Networks matter because they carry it. The subject also includes policies, training, and decisions made before an incident occurs. We begin by separating cybersecurity from information security, and from privacy. Then we examine confidentiality, integrity, and availability, the three goals behind security decisions. Five working domains divide the practical work, while protecting the same valuable center. Organizations of every size need protection, because weakness can attract attention without a famous name. Finally, responsibility belongs to leadership, technology teams, and everyone who uses a system. The central lesson is simple: protection depends on these parts working together.
Protection Has Layers
Technology, Policy, and Behavior
Think of a building: locks provide technology, while locking-up instructions provide policy. Keeping the side door closed, instead of propping it open, is everyday behavior. Good locks achieve little when the rules or habits undermine them. Digital protection has the same dependence on technology, policy, and behavior. Cybersecurity covers digital information, the systems processing it, and disruptions or losses affecting both. Information security reaches beyond digital systems, to paper files and spoken conversations. Privacy asks a different question: should the information have been collected or retained at all? A database can be carefully protected, yet contain information gathered without a legitimate justification. That situation remains a privacy failure, even when access controls are technically effective. Keeping the terms separate prevents a security claim from hiding an inappropriate data practice.
Three Security Goals
Confidentiality, Integrity, and Availability
The three security goals are confidentiality, integrity, and availability, often called the security triad. Confidentiality means information is viewable only by people with a legitimate reason to see it. Integrity means information remains accurate, without unauthorized alterations to its contents. Availability means systems and information are usable when people need them. These goals describe outcomes, rather than particular products or tools an organization buys. A permission setting supports confidentiality, by limiting who can open a record. A change log supports integrity, by making alterations traceable and open to review. A backup supports availability, by helping recover information after a failure. Each goal protects a different aspect of the same information at the center. The challenge is to protect all three, with a balance suited to actual needs.
Judgment Over Checklists
Strengthening 1 Goal Can Weaken Another
Confidentiality fails when customer records appear for sale, despite being intended for restricted access. Integrity fails when a supplier's bank details are quietly changed, diverting payments elsewhere. Availability fails when a hospital cannot open patient records during a night shift. Useful controls include encryption and permissions, change checks and signatures, backups and spare capacity. But stronger protection of one goal can interfere with another goal. Requiring five approvals before opening a file may restrict access, while delaying legitimate work. Keeping thirty copies may improve access, while creating thirty opportunities for unwanted disclosure. The source's hospital review asks about three approvals, where delayed records can affect emergency treatment. Rapid emergency access, logged for later review, illustrates a more suitable balance in that situation. An emergency room and an accounting firm therefore need judgment, rather than identical checklists.
Working Domains
Connections and Software
Network security protects the connections carrying data between devices and between sites. Firewalls, separated network segments, intrusion detection, and encrypted tunnels are examples of network controls. Without segmentation, reaching one machine may let an attacker move across the wider network. Application security instead protects the software itself, including applications developed inside the organization. Its controls include secure coding, input checking, code review, patching, and testing. A poorly protected web form may allow access to an entire customer database table. That failure belongs to the software pathway, rather than simply an unlocked physical device. These domains identify where protection must operate, and which expertise can improve it. They are not isolated subjects, because software depends on networks and both handle information. Protecting one pathway well does not make the remaining pathways safe automatically.
Working Domains
Data, Routines, and Devices
Information security protects data while stored, and while moving, wherever its system happens to be. Encryption, sensitivity labels, access permissions, retention limits, and backups support this domain. An unprotected cloud storage location can expose years of records to the public internet. Operational security covers the rules, processes, and human routines surrounding technical systems. Access reviews, change approvals, response plans, training, and supplier checks are operational controls. An account left active eight months after an employee departs illustrates an operational failure. Endpoint security protects individual devices, including laptops, desktops, phones, tablets, and servers. Device protection, disk encryption, automatic updates, screen locks, and remote wiping provide relevant controls. An unlocked phone left in a taxi can expose company email to whoever finds it. Together, these domains protect information through data controls, dependable routines, and secure devices.
Overlapping Defenses
An Incident Crosses Domain Boundaries
Imagine an employee enters a password into a convincing, but false, sign-in page. The employee's device makes endpoint protection relevant, while training and reporting involve operational security. Second-factor sign-in also forms part of the operating arrangements that can interrupt the sequence. Access permissions determine what the stolen credentials can reach, bringing information security into the incident. If the attacker reaches a file server through connected systems, network separation matters too. Real incidents cross domain boundaries, rather than fitting neatly into a single specialist's category. The source asks us to consider a dental practice with six staff and one server. It also has appointment software, and staff phones connected to the office wireless network. Work through all five domains, naming a plausible weakness in each, before comparing possible improvements. Choose the improvement that reduces the most risk for its cost, and explain the trade-off.
Targets of Opportunity
Small Size Does Not Prevent Discovery
A small organization may assume it is too unimportant to attract an attacker. That belief pictures someone choosing targets deliberately, based on a company's name and reputation. Automated scanning instead searches large ranges of internet addresses, looking for exposed weaknesses. The tool does not need to care who owns the system it finds. An eleven-person organization can therefore be discovered just as a larger organization can. Smaller firms may lack a dedicated specialist, and may apply updates late or inconsistently. One person may also hold all administrative privileges, concentrating the consequences of compromise. A serious incident can threaten the whole business, rather than being absorbed as a manageable cost. Smaller suppliers can also become routes into larger customers, making their relationships valuable to attackers. Size affects what can be lost. It does not provide protection against discovery.
Sector Consequences
The Valuable Information Varies
The information worth protecting changes across sectors, along with the consequences of a serious incident. Healthcare holds patient histories, insurance details, and prescriptions; exposure can accompany delays in treatment. It can also produce canceled appointments, regulatory penalties, and lasting damage to patient trust. Retail and hospitality hold payment, loyalty, and supplier details, risking suspended processing, refunds, and fines. Education holds enrollment records, research, and family contacts, with assessment disruption and exposure of minors' information. Manufacturing holds designs, production schedules, and machinery controls; disruption can halt production and breach contracts. Copied designs can also appear elsewhere, making lost information a competitive harm. Professional services hold confidential documents, case files, and deals, risking client relationships and professional duties. Nonprofit and community organizations hold donor, payment, and beneficiary records, sometimes involving vulnerable people. Across these examples, security protects the ability to serve people, as well as valuable records.
Ordinary Starting Points
Routine Weaknesses Deserve Routine Attention
Incidents often start with ordinary weaknesses, rather than an unusual technical achievement. A reused password, a convincing message, or a wrong setting can open the first route. The source illustrates this pattern, but its chart proportions are illustrative rather than measured statistics. We should keep the practical lesson, without treating those proportions as precise evidence. Strong, unique passwords reduce reliance on credentials reused across different services. Second-factor sign-in adds another requirement, rather than letting a password alone settle access. Care with unexpected messages helps prevent deception from becoming a harmful action. Updates and correct settings reduce weaknesses that remain open through neglect or misunderstanding. Device locks limit immediate access when a phone or computer is left unattended. Prompt reporting helps contain an event, because noticing something unusual matters only when someone acts.
Shared Responsibility
Each Tier Owns a Different Contribution
Leadership owns direction, budgets, and decisions about accepting or refusing risks. It must also keep protection important when a deadline creates pressure to bypass safeguards. Technology and security teams design defenses, apply updates, monitor unusual activity, and respond to incidents. They also advise the business, using language decision-makers can understand and act on. Every user owns careful sign-in, caution with messages, device locking, and reporting suspicious events. Technology teams cannot stand beside every person, at the moment a questionable link appears. Leadership cannot substitute for systems that were never updated, however committed its statements may sound. Careful users cannot supply the missing authority or budget required to maintain protection. Expectations flow downward, from leadership to practical controls and then everyday behavior. Warnings must flow upward just as freely, so the whole organization can respond in time.
A Reporting Culture
Silence Expands the Damage
Compare two organizations with the same failure: publicly exposed records in a cloud storage location. In the first, an employee notices within an hour, and reports the problem promptly. In the second, the employee stays silent for three weeks, fearing blame for speaking up. The technical failure is identical. The difference lies in operational security, and the reporting culture. Prompt reporting shortens the exposure window, supporting containment and timely communication with affected people. Silence leaves information exposed longer, and may force discovery through an outside party instead. Punishing honest mistakes teaches people to hide them, allowing a containable event to grow. Shared responsibility therefore includes creating conditions where a warning can be raised within minutes. Keep the complete picture: information and access, three goals, five domains, and three responsible tiers. Security holds when all these parts work together, and fails when one can undermine the rest.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About What Cybersecurity Means and Why Every Organization Needs It
What is the difference between cybersecurity, information security, and privacy?
What are the five domains of cybersecurity?
Why do hackers target small businesses?
Who is responsible for cybersecurity in an organization?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →