YanoSecA club needs its contact list to stay private and its timetable to stay usable. Losing either can interrupt real work. Cybersecurity is the work of protecting digital information and the systems people depend on, including preparing for mistakes and recovering when something goes wrong.
An asset is something valuable that needs protection, such as notes, an account or an online service. Risk concerns what could go wrong, how likely it is, and how serious the harm could be. A control is an action or measure used to reduce that risk. Start with the asset and the harm so you can choose a control for a reason.
Before you begin
- Recommended first
- Nothing. No earlier lesson or technical experience is required.
- Estimated time
- 10 min reading, 10 min activity. Setup and optional practice may take longer.
- Where you work
- Work on this lesson page in a desktop or mobile browser, with paper or a text editor for notes. You need no installation, account or terminal. The cases describe invented situations; your task is to read and reason about them.
- Without a lab
- Every worksheet appears in full on the page. A download saves a copy to your device; it is optional. If you cannot download, copy the fields into your notes. Without JavaScript, predict the decisions and explain your reasons on paper. Answer checking needs JavaScript; keeping the result after you leave also needs browser storage.
After this lesson you can:
- Name an asset and a specific way it could be harmed.
- Choose a protective action that addresses the stated problem.
- Explain one problem the chosen action would leave unresolved.
01Example
In this invented example, the problem is someone seeing private information on an unattended screen. Follow the link between that harm and the chosen action. The last line states a limit of the action.
Asset: private club contact list
Situation: a shared laptop is left signed in and unattended
Possible harm: a passerby reads the list
Control: lock the screen before leaving
Reason: using the signed-in screen now requires unlocking it
Limit: locking does not undo information already copied02Name what matters
An asset can need several kinds of protection. A contact list should stay private while remaining available to the people allowed to use it. A timetable should keep the correct entries so people know when to attend.
Confidentiality means keeping information from people who are not allowed to see it. Integrity concerns keeping information correct and protecting it from inappropriate changes. Availability means being able to use the information or system when it is needed. These names help you say which need a problem affects.
An incident is an event that harms security, such as disclosure of private information or loss of an important service. The cause can be deliberate or accidental. Accidental deletion still matters even when nobody intended harm.
03Choose a control for the harm
In the example, locking the screen addresses someone using an unattended signed-in session. It does not recover a deleted list. For loss of information, a backup may help: it is a separate copy kept so you can restore the information if the working copy is lost or damaged.
Access controls restrict who may read or change information. They address a different problem from recovering a lost copy. Ask what the action actually changes before deciding whether it fits the harm.
No single control solves every problem. A backup is useful only if the needed information can be restored from it, and private backup data still needs protection. NIST's basic guidance recommends protecting and testing backups as well as making them.
Screen locking addresses the unattended-screen harm; it does not recover information already copied.Model. A teaching model drawn by hand. It shows the idea, not real tool output.
Read the full explanation below.
private club contact list
met · private listshared laptop left signed in and unattended
met · passerby may read the screenlock the screen before leaving
unmet · screen not yet locked in this modelThe unattended signed-in screen exposes this reading path.
No actual disclosure is observed.
The unattended signed-in screen exposes this reading path.
Follow the explanation
- The unattended signed-in screen exposes this reading path.
- Screen locking addresses this access path by requiring unlocking.
Read every state and value
1. The unattended signed-in screen exposes this reading path.
- Case
- unlocked
- Conditions inspected
- Asset · Access path · Control
- Decision shown
- Yes
2. Screen locking addresses this access path by requiring unlocking.
- Case
- locked
- Conditions inspected
- Asset · Access path · Control
- Decision shown
- Yes
04Match three cases
Use the invented cases below to choose a control. Work in your notes: you do not need to delete a file, change an account or alter a real system.
FICTIONAL CASES
CASE 1
Asset: private club contacts
Possible harm: a passerby reads an unattended signed-in screen
Choices: lock the screen / change its background picture
CASE 2
Asset: practice notes
Possible harm: the only copy is accidentally deleted
Choices: keep a tested recoverable copy / rename the folder
CASE 3
Asset: shared timetable
Possible harm: anyone can accidentally overwrite the entries
Choices: restrict editing to authorized editors / change the font- For each case, write what needs protection and what could happen to it. Identify whether the main need is privacy, correctness or availability.
- Choose one of the two actions and finish this sentence: this reduces the stated harm because… Describe the connection rather than repeating the action's name.
- Name one problem each chosen action leaves unresolved. For example, a locked screen does not bring back a list deleted yesterday.
- Compare each choice with its harm. Your three reasons should explain how the actions restrict reading, support recovery or restrict editing. If an action only changes appearance, reconsider how it would prevent the stated harm.
05People and systems
Cybersecurity also depends on people being able to use the controls. A recovery procedure may fail if nobody knows where the copy is or how to restore it. Clear instructions, responsibility and practice help make protection usable.
The aim is to reduce harm while allowing useful work. The next lesson introduces authorized security testing and defensive work. Both connect back to the same question: which problem are we trying to reduce?
06Optional challenge
Allow about 5 extra minutes. Choose one case and name a different harm its selected action does not address. Suggest a second action and explain why it fits that different harm. Keep this a written plan for the fictional case.
07Fresh cases for the checks
Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.
Security case AOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
The club keeps a private attendance file. Only two coordinators should read it. A public link currently lets anyone read it. A separate inventory file was accidentally deleted. A backup of that inventory exists, but nobody has checked whether it opens or contains the needed entries.
08Explain a remaining risk
Optional written self-check: For each proposed control, state which harm it reduces and one harm it leaves open. Check that a backup remains protected and tested, and that restricting future reading does not erase information someone already copied.
09Common mistakes
If you assume every incident is an attack, reread the harm in the case. Accidents can also make information wrong or unavailable.
If a copy exists but has never been checked, do not claim recovery is proven. The useful outcome is restoring the information that is needed.
If several actions seem useful, choose the one that directly addresses the named harm. Record the other problems separately.
If downloading is unavailable, use the full cases on the page. No real deletion or account change is required to compare the choices.
References
- NIST: Cybersecurity Basics
Optional guidance on everyday protective actions, including keeping, protecting and testing backups.
- NIST Cybersecurity Framework 2.0
A reference for organizing work to manage security risk. It includes protection, detection, response and recovery; you do not need to memorize its categories.