# Cybersecurity Cybersecurity is the practice of protecting computer systems, networks, and data from unauthorized access, damage, or disruption. It sits at the intersection of Computer Science, national security, and geopolitics — the domain where software vulnerabilities become weapons, where a single [[Zero-Day]] exploit can disable critical infrastructure, and where the line between espionage and warfare blurs. The vault's [[Cybersecurity Lexicon]] catalogs the terminology; this page covers the structural framework. ## Attack Vectors **Phishing and social engineering** remain the most common initial access vectors. [[Spearphishing]] targets specific individuals with tailored lures — it was the entry point for the 2016 DNC hack and countless corporate breaches. [[SIM Swapping]] hijacks phone numbers to bypass two-factor authentication. [[Typosquatting]] registers domains similar to legitimate ones to harvest credentials. **Software exploitation** targets vulnerabilities in code. [[Zero-Day]] exploits — attacks on unknown vulnerabilities with no available patch — are the most valuable weapons in the cyber arsenal. Nation-states including the US, Russia, China, and Israel stockpile zero-days for offensive operations. The [[Stuxnet and Cyber Warfare Origins]] case used four Windows zero-days simultaneously. **[[Supply-Chain Attack]]s** compromise trusted software distribution channels. The SolarWinds attack (2020), attributed to Russian intelligence, inserted malicious code into a network management tool used by 18,000 organizations including multiple US government agencies. [[Hack-and-Leak Operation]]s combine intrusion with strategic disclosure to achieve political objectives. **[[Ransomware-as-a-Service]]** has industrialized cybercrime, with criminal groups offering ransomware toolkits to affiliates in exchange for a cut of proceeds. [[Wiper Malware]] masquerades as ransomware but aims to destroy data — Russia deployed wipers extensively against Ukrainian infrastructure. ## Defense in Depth Cybersecurity defense follows a layered approach. Network perimeter security (firewalls, intrusion detection) forms the outer ring. Endpoint protection (antivirus, endpoint detection and response) guards individual devices. Identity and access management controls who can access what. [[Encryption]] protects data in transit and at rest. Security monitoring and incident response detect and contain breaches that penetrate defenses. The "zero trust" architecture — never trust, always verify — has replaced the older perimeter-based model. Every access request is authenticated and authorized regardless of network location, reflecting the reality that insiders and compromised credentials are as dangerous as external attackers. ## Nation-State Cyber Operations Cyber operations have become a primary instrument of state power. [[Russian Cyber Warfare]] encompasses election interference, infrastructure disruption, and intelligence collection. [[Russian State Hacking Groups]] (APT28/Fancy Bear, APT29/Cozy Bear, Sandworm) are among the most prolific state-sponsored threat actors. [[Chinese State Hacking Groups]] (APT1, APT10, APT41) focus on intellectual property theft and espionage at industrial scale. The US maintains offensive cyber capabilities through [[NSA]]'s Tailored Access Operations and US Cyber Command. The [[Five Eyes Alliance]] coordinates cyber intelligence and defense across the US, UK, Canada, Australia, and New Zealand. [[Cyber War]] as a concept raises legal and strategic questions: when does a cyberattack constitute an act of war? What are proportionate responses? These questions remain unresolved in international law, even as cyber operations escalate. ## Cybersecurity and the Defense Tech Ecosystem The [[Defense Tech Ecosystem]] increasingly depends on cybersecurity. [[Palantir]]'s intelligence platforms, military command-and-control systems, and autonomous weapons all require secure software and networks. [[Cloudflare]] and similar firms provide DDoS protection that keeps critical infrastructure online. The intersection of [[Artificial Intelligence Hub]] and cybersecurity — AI-powered threat detection and AI-generated attacks — is an accelerating frontier. ## See Also - [[Cybersecurity Lexicon]] — comprehensive terminology reference - [[Cyber War]] — strategic and legal dimensions - [[Information Warfare Hub]] — the broader information conflict landscape - Signals Intelligence and Computing — the intelligence side of cyber operations - [[Cryptography]] — the mathematical foundation of digital security