Free preview. The first lesson of Cyber Security Fundamentals, exactly as enrolled students see it. No account needed.
Cyber Security Fundamentals · Day 1: Cyber Threats & Vulnerabilities
What Cybersecurity Protects, and From Whom
Welcome to Cyber Security Fundamentals. Before any tool or technique, this first lesson answers a simpler question: what is cybersecurity actually trying to protect, and who is it protecting it from? Get this foundation right and everything later in the course -- passwords, phishing, malware, networks, cloud, risk -- will click into place as a specific answer to one of these two questions.
What Cybersecurity Means
Cybersecurity is the practice of protecting computers, networks, programs, and data from unauthorised access, damage, or disruption. That sounds abstract, so make it concrete: it means a bank's mobile app only lets the real account holder move money, a telecom's customer database doesn't leak millions of phone numbers, and an oil and gas company's control systems keep running safely even when someone is actively trying to interfere with them. Three sectors, three completely different systems, the same underlying goal.
You do not need a computer science degree for this. Some of the strongest security professionals come from accounting, law, or operations backgrounds. What you need is curiosity, patience, and a habit of thinking like both a defender and an attacker at the same time -- that habit starts here.
The Vocabulary: Threat, Vulnerability, Risk
These three words get used interchangeably in casual conversation, but precision matters. A threat is any potential danger -- a criminal group, a careless employee, a natural disaster, even simple human error. A vulnerability is a specific weakness a threat could exploit -- an unpatched server, a weak password, an untrained employee who clicks anything in their inbox. Risk is what results when a threat meets a vulnerability: informally, risk equals likelihood multiplied by impact. Neither a threat with nothing to exploit, nor a vulnerability no one will ever target, is a meaningful risk on its own -- it's the combination that matters, and that combination is what the rest of this course trains you to spot and reduce.
Common Cyberattacks, at a Glance
You will study each of these in real depth in later days, so this is deliberately just an orientation map. Phishing tricks people into handing over credentials or clicking something malicious. Malware is software designed to damage, disrupt, or gain unauthorised access. Denial-of-service floods a system until real users can't get through. Credential theft takes a password or access token, then uses it to walk in the front door instead of breaking a window. Notice that most of these don't require exotic technical genius -- they exploit basic oversights, over and over, in different organisations, in different countries.
Attack Surfaces and Threat Actors
An organisation's attack surface is every possible point where an unauthorised person could try to get in or extract data -- every login page, every employee's laptop, every third-party vendor connection, every forgotten server nobody remembers is still running. The bigger and messier the attack surface, the more places a defender has to watch.
Threat actors are the people or groups behind attacks, and they are not one type. Organised criminal groups pursue financial gain. Nation-state actors pursue espionage or disruption, sometimes against critical infrastructure specifically. Hacktivists pursue a political or social cause. And insider threats -- a current or former employee, contractor, or partner with legitimate access -- are often the hardest to defend against precisely because they don't need to break in at all; they're already inside.
Human Vulnerabilities
The single most exploited vulnerability in almost every organisation isn't a piece of software -- it's a person, under time pressure, trusting something that looks legitimate. This is why Module 3 of this course is entirely dedicated to phishing and social engineering, and why "human-factor vulnerability" will come up constantly across every sector pathway later in this course.
Why No Organisation Is Too Small
Attackers do not only target huge multinationals. Small businesses, local government offices, schools, and hospitals get targeted too -- often precisely because they have weaker defences and fewer resources to recover. That includes organisations right here in the country, across every size and sector. Nobody is too small to be a target; smaller organisations are frequently targeted because they're small.
Bringing It Together
This lesson introduced cybersecurity's core vocabulary -- threat, vulnerability, risk -- a map of common attacks, the idea of an attack surface, and the range of threat actors an organisation actually faces, including the insider threat and the human vulnerability that shows up in nearly every real incident. Next lesson goes one level deeper: basic vulnerability management, and how organisations actually start turning this vocabulary into a practical, ongoing discipline.
Want the rest of the course?
35 more lessons across 18 days, each with an illustration and a video, plus assignments, quizzes, a capstone project and a certificate of completion. Self-paced, with lifetime access. Course fee: ₦200,000. Or start with ₦20,000 and pay the balance later.