Cyber security foundations.

The core ideas

Cyber security protects information and the systems that hold it. Its goals are usually summed up as three properties, often called the CIA triad:

• Confidentiality: only the right people can see the information.
• Integrity: the information is accurate and has not been changed without authority.
• Availability: the information and systems are there when they are needed.

Security work is about risk. A threat is something that could cause harm, such as a criminal group or a careless mistake. A vulnerability is a weakness it could exploit, such as an unpatched server or a reused password. The risk is how likely the harm is and how bad it would be. Because no organisation can remove every risk, the work is deciding which ones to reduce first.

Security is not only a technology problem. Most successful attacks involve people (a convincing message, a reused password, a rushed approval), and good security combines technology, clear processes and trained staff.

The attacks that happen most

Most organisations face the same handful of attacks again and again:

• Phishing: messages that trick people into clicking a link, opening a file or giving away a password. It arrives by email, by SMS (smishing) and by phone call (vishing).
• Stolen and reused passwords: attackers try passwords leaked from one site on many others, a technique called credential stuffing.
• Ransomware: malicious software that encrypts an organisation's data and demands payment, often after stealing a copy to threaten publication.
• Business email compromise: an attacker takes over or imitates a trusted email account to redirect payments.
• SIM swap: a criminal persuades a mobile operator to move a victim's number to a new SIM, then receives their one-time passcodes. This matters wherever phones are used to approve payments, including mobile money.
• Unpatched systems: known weaknesses in software that has not been updated.
• Insider threats: staff or contractors who misuse their access, deliberately or by mistake.

Attacks also come through suppliers: a compromised software update or service provider can give an attacker a way into every organisation that uses it.

Controls that stop most attacks

A small set of basic controls prevents a large share of real attacks:

• Multi-factor authentication (MFA) on email, remote access and administrator accounts. Phishing-resistant methods, such as security keys and passkeys, are stronger than codes sent by SMS, which a SIM swap can intercept.
• Patching: apply security updates quickly, starting with systems that face the internet.
• Least privilege: give each person and system only the access they need, and review it regularly.
• Backups that ransomware cannot reach. A common rule is 3-2-1: three copies of important data, on two different kinds of storage, with one kept off site, plus at least one copy offline or unchangeable. Test that restores actually work.
• Logging and monitoring, so unusual activity is noticed and can be investigated later.
• An asset inventory: you cannot protect systems you do not know you have.
• Encryption of sensitive data, both stored and in transit.
• Awareness training, so staff recognise phishing and know how to report it without fear of blame.

A modern way to tie these together is zero trust: no user or device is trusted just because it is inside the network. Every request is checked for who is asking, from what device, and whether they need that access.

Frameworks and Kenyan law

Frameworks help an organisation organise its security work and measure progress. Two are widely used:

• The NIST Cybersecurity Framework, published by the US National Institute of Standards and Technology. Version 2.0, released in 2024, groups security outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover.
• ISO/IEC 27001, the international standard for an information security management system. Organisations can be independently certified against it.

In Kenya, several laws apply:

• The Computer Misuse and Cybercrimes Act, 2018 sets out cybercrime offences, such as unauthorised access to computer systems.
• The Data Protection Act, 2019 requires appropriate security for personal data, and requires organisations to notify the Data Commissioner of a personal data breach that poses a real risk of harm, generally within 72 hours of becoming aware of it, and to inform affected people in the circumstances the Act sets out.
• Sector regulators, such as the Central Bank of Kenya for banks and payment providers, also issue their own cyber security requirements.

The national computer incident response team, KE-CIRT/CC, operated by the Communications Authority of Kenya, coordinates the response to cyber incidents and publishes advisories.

Responding to an incident

Every organisation will face incidents. What matters is being ready. A widely used model describes the response in stages:

• Prepare: a written plan, named roles, contact lists, and backups and logs that you know work.
• Detect and analyse: confirm what happened, which systems and data are affected, and how serious it is.
• Contain: stop the spread, for example by isolating affected machines or disabling a compromised account.
• Eradicate and recover: remove the cause, restore from clean backups and watch closely for signs of return.
• Learn: review what happened and fix the weaknesses that allowed it.

Throughout, preserve evidence such as logs and affected files, keep a timeline of decisions, and meet legal duties such as breach notification. Paying a ransom does not guarantee that data will be returned or deleted, and can raise legal issues, so take legal advice first.

Automation can speed up detection and containment, but actions with a large impact, such as shutting down a production system or locking out a senior user, should run under an approved plan, with a person's approval where the plan requires it.

Saolix Shield, in development, is designed around this principle: security events are brought into one timeline, AI suggests a likely attack path and a response, and the response runs only under approved policy, with approvers where the policy requires them. You can explore the idea in the Shield concept simulator.

Your certificate of completion

Enter your name as you want it to appear, then save the certificate as a PDF. In the print window, choose Save as PDF.

Saolix does not record who takes this course, so it cannot verify these certificates. The certificate confirms completion of a free self-paced course and is not an accredited qualification.