Cybersecurity reference data
Security principles, threats, and defensive practices.
Topic guide
What Cybersecurity covers
Cybersecurity reference data names the building blocks defenders and attackers both talk about: how users prove who they are (authentication factors), how data is protected in transit and at rest (cryptographic algorithms and primitives), what attackers do (malware and the OWASP web vulnerability classes) and which controls sit in the network to stop them. The vocabulary is stable, but recommendations age quickly: algorithms get deprecated, vulnerability rankings are revised and tools change names, so each entry is a starting point to verify against current guidance.
Key ideas
- Confidentiality, integrity, availability
- The CIA triad: keep data secret, keep it correct, and keep it reachable. Most controls serve one of the three.
- Authentication vs authorization
- Authentication establishes who someone is; authorization decides what they may do. Broken access control is a failure of the second.
- Defense in depth
- Layering independent controls so that the failure of one does not expose everything.
- Threat model
- A deliberate description of what you are protecting, from whom, and by which paths. Controls are chosen against it.
- Symmetric vs asymmetric cryptography
- Symmetric ciphers use one shared key and are fast; asymmetric systems use a key pair and solve key distribution and signatures.
- Hash vs encryption
- A hash is one-way and used for integrity and password storage; encryption is reversible with a key.
- CVE
- A public identifier for a specific known vulnerability, used to track patches and exposure.
Common pitfalls
- Rolling your own cryptography or mixing primitives without a reason. Use vetted libraries and authenticated encryption.
- Storing passwords with a general-purpose fast hash. Use a purpose-built slow function such as Argon2id, bcrypt or scrypt.
- Treating SMS codes or knowledge questions as strong factors. Possession and inherence factors vary a lot in resistance to phishing.
- Reading a ranking such as the OWASP Top 10 as a complete list rather than the most common categories at the time it was compiled.
Using it from an agent
- State the edition or date when quoting a ranking or recommendation (for example OWASP Top 10, 2021) so it can be rechecked.
- Describe attack techniques at the level of category and defense; do not generate working exploit code from a vulnerability name.
- When recommending an algorithm, give the current default and name the ones to avoid (MD5, SHA-1, DES, RC4 for new designs).
Start with: OWASP Top 10 Vulnerabilities · Cryptography Basics
Datasets in Cybersecurity
-
Authentication Factors
Categories of authentication evidence.
6 entries -
Cryptographic Algorithms
Overview of symmetric, asymmetric, hashing, and key exchange algorithms.
17 entries -
Cryptography Basics
Fundamental cryptographic concepts.
16 entries -
Malware Types
Common categories of malicious software.
15 entries -
Network Security Devices
Devices used to protect networks.
16 entries -
OWASP Top 10 Vulnerabilities
The OWASP Top 10 web application security risks.
10 entries
Fetch this category
One request returns the category with all of its dataset summaries. Append
?format=yaml or ?format=toon for the other encodings.
GET https://yjtoon.com/api/category/cybersecurity?format=json