SimplifiedCS

New to cybersecurity? Just took on IT for a company that never had a dedicated setup before? This page is the on-ramp - the foundational concepts worth understanding before you touch the actual assessment, written in plain language, in an order that actually makes sense to read top to bottom. If you already know this material, the assessment itself and the Glossary will serve you better than this page will.

Access control decides who can do what - and it's the foundation everything else sits on, because a strong password policy doesn't matter if the wrong person already has admin rights they never needed.

The principle of least privilege means giving people access to exactly what their role requires, nothing more. An access control list (ACL) is the practical mechanism for this - a defined set of permissions attached to a system, file, or resource, specifying exactly who can read, write, or execute it. See the Glossary for more on least privilege specifically.

Password policy is more than "make it long." A genuinely useful policy covers minimum length (current guidance favors length over complex character requirements), discouraging reuse across systems, and - critically - requiring multi-factor authentication (MFA) wherever it's available, since a strong password alone is no longer considered sufficient on its own.

Passkeys are a newer, stronger alternative to passwords entirely. Instead of a shared secret you type in (which can be phished, guessed, or leaked in a breach), a passkey uses public-key cryptography tied to your device - you approve a login with your fingerprint, face, or device PIN, and there's no password for an attacker to steal in the first place. They're built on the FIDO Alliance's open standard and are increasingly supported across major platforms (Microsoft, Google, Apple accounts all support them today).

Identity management is how an organization handles all of this at scale - who has an account, what they can access, and how that access changes as people join, move roles, or leave. Larger organizations typically centralize this through an identity provider (IdP) with single sign-on (SSO), so access can be granted or revoked from one place rather than chasing down permissions system by system.

Device management covers every laptop, phone, and workstation that touches company data. The key question: is a device company-owned and centrally managed, or is it an employee's personal device being used for work (BYOD - "bring your own device")? Company-owned devices are far easier to secure consistently; BYOD introduces real tradeoffs between employee flexibility and the organization's ability to enforce security settings. Mobile Device Management (MDM) tools exist specifically to apply consistent security policy - screen locks, encryption, remote wipe - across a fleet of devices regardless of who owns them.

Data classification means knowing what kind of data you actually have before you can protect it properly. Not all data carries the same risk - personally identifiable information (PII), financial records, and health data typically demand stronger protection than, say, public marketing material. Classifying data (even informally, as "sensitive" vs. "general") is what makes the rest of your security decisions possible to prioritize correctly.

Encryption protects data in two different states, and both matter: encryption at rest protects data sitting on a disk or in a database; encryption in transit protects data as it moves across a network. A system can have one without the other, and both gaps are real.

Where does your organization's technology actually live? Cloud vs. on-premises is the first fork - and most organizations today run a mix of both, not a clean either/or.

Within cloud services, it helps to know the three common models: SaaS (Software as a Service - you use a finished application, like email or CRM, and the provider manages everything underneath it), PaaS (Platform as a Service - you deploy your own code onto infrastructure the provider manages), and IaaS (Infrastructure as a Service - you manage the operating system and everything above it, on infrastructure the provider hosts). Each model shifts a different amount of security responsibility onto you versus the provider - worth knowing which model you're actually using for a given system.

Basic network concepts worth understanding early: a firewall controls what traffic is allowed in or out of a network based on rules; a VPN (virtual private network) creates an encrypted tunnel for remote access; network segmentation means dividing a network into smaller, isolated zones so that a compromise in one area doesn't automatically grant access to everything else.

Backups are the single most consistently under-tested control in most organizations. The well-established guideline is the 3-2-1 rule: keep at least 3 copies of your data, on 2 different types of storage media, with at least 1 copy stored offsite. Critically - a backup that has never been tested for restoration isn't a real backup, it's an assumption. Ransomware specifically targets backups when it can reach them, which is exactly why the offsite/isolated copy matters most.

Patching means applying vendor-released updates that fix known vulnerabilities. The gap between a patch being released and it actually being applied is exactly the window attackers look for - this is why frameworks like NIST CSF and tools like CISA's Known Exploited Vulnerabilities catalog exist to help prioritize which patches matter most urgently, not just track that patches exist.

Endpoint protection (antivirus, and its more capable modern successor, EDR - endpoint detection and response) is the layer watching individual devices for malicious activity, not just blocking known-bad files but detecting suspicious behavior in real time.

Technology alone doesn't secure an organization - the people using it are part of the system, for better or worse.

Security awareness training teaches staff to recognize real threats (phishing emails, social engineering attempts, unsafe practices) - but training without reinforcement fades. That's why phishing simulation exists: periodically sending realistic, safe test phishing emails to see who clicks, then using that as a coaching opportunity rather than a punishment.

Incident response, at a foundational level, just means having a plan before something goes wrong - who gets notified, who has authority to make decisions, and what the first steps are. This page won't go deep here; the site's Runbooks are built specifically for that level of detail once you need it.

None of the above requires expensive tooling to start doing well, but the right category of tool makes consistency much easier at any real scale. Presented here at a category level, not as endorsements of specific products:

• Password managers - generate and store strong, unique passwords per site/system, removing the human tendency to reuse passwords across services.
• MDM platforms - apply and enforce device security policy across a fleet, rather than trusting each device to be configured correctly by hand.
• Identity/IAM platforms - centralize who has access to what, with single sign-on and centralized deprovisioning when someone leaves.
• Backup solutions - automate the 3-2-1 pattern rather than relying on someone remembering to do it manually.