What is cybersecurity?

A shopkeeper locks the door at night. She also keeps the takings in a safe. She gives a spare key to one person only. She writes down who opened up each morning. And she keeps a second set of records at home, in case the shop ever burns down.

Every one of those habits guards something different. The lock keeps strangers out. The safe limits the loss if the lock fails. The written record says who was there. The copy at home means a fire does not end the business.

Cybersecurity is that same set of habits, applied to computers, phones and the data on them. It is a practice. No single product supplies it.

What you are actually protecting

Three things. Security people have used the same three for decades, so they are worth learning.

• Secrecy. Only the right people can see the data.
• Correctness. Nobody can change the data without permission, or without being noticed.
• Availability. The system is there and working when you need it.

Most people think only of the first one. The other two often do more damage when they fail. A bank whose balances can be quietly edited is in worse trouble than a bank whose balances leaked.

Who attacks, and why

• Criminals who want money. This is the large majority of attacks.
• Governments, who want information or the power to switch something off.
• Insiders, who already hold a key. Sometimes angry, more often just careless.
• People doing it for status or for fun.

The first group decides how most of us should plan. Criminals pick the easy target, because their business runs on volume. Therefore you do not have to be perfect. You have to be more work than the next door along the street.

How attacks actually start

Almost never the way films show it. There are three common front doors.

The first is a message that tricks a person. That is phishing. Somebody clicks a link, types a password into a copy of a login page, and the attacker walks in holding a real key.

The second is a password that was already stolen somewhere else. People reuse passwords, so one leak at one website opens many doors.

The third is software that was never updated. Somebody finds a hole, the maker publishes a fix, and the machines that never applied it stay open for years.

Notice how ordinary that list is. The attacks that work are boring.

The layers that actually help

Security works in layers, because any single layer will fail one day.

• Multi-factor login. A password plus a code or a small key. This alone stops most stolen-password attacks.
• Updates, applied quickly, on every device you own.
• Least privilege. Each person and each program gets only the access the job needs.
• Backups kept offline, and tested by actually restoring them.
• End-to-end encryption for messages, so a stolen copy cannot be read.
• Logs, so you can answer the question “what happened here” afterwards.

Order matters more than length here. If you can only do one of them, do the first. Multi-factor login blocks the attack that begins with a stolen password, and that is where most trouble begins.

The modern name for arranging these layers well is zero trust. The old model trusted anything already inside the office network. Zero trust checks every request, every time, wherever it comes from.

What security cannot do

It cannot make you safe. There is no such state. Every real system trades safety against cost, and against how annoying it is to use.

Push too hard and people work around you. Staff forced to change a password every month write it on a note under the keyboard. That is not stupidity. That is a design failure.

So aim at something else. Make attacks expensive. Make them slow. Make sure you notice. Then plan for the day one succeeds anyway.

Where you already meet it

The padlock in your browser bar. The code your bank sends you. The fingerprint that opens your phone. The update that arrives while you sleep. The chat app that says your messages are encrypted.

Each of those is one of the layers above, hidden behind a small piece of design so you barely notice it. Good security is quiet. You feel it only when it is missing.

What this means where the phone is the bank

In Kenya, mobile money carries a large share of everyday payments. The phone is the wallet, the shop till and the bank branch at once. That changes what an attacker wants from you.

The attack to know here is the SIM swap. The criminal gathers a few facts about you. Then they persuade or bribe someone at a mobile shop to move your number onto a new SIM card. After that, your confirmation codes arrive on their handset. Your password never leaked. Your phone number was the key.

Therefore guard the number itself. Set a PIN on the SIM. Ask your operator what proof they demand before they move a number. And if your phone loses service for no clear reason, treat that as an alarm and call the operator at once.

What to do this week

Do three things, in this order. Turn on multi-factor login for your email first, because email can reset every other password you own. Then update every device in the house. Then check that you hold a backup of anything you cannot lose, and restore one file from it to prove the backup works.

If you run a business, add a fourth. Learn what ransomware does before it happens to you, because that is the attack most likely to close your doors for a week. YOUR EMAIL IS THE MASTER KEY TO EVERYTHING ELSE.

Just Out Tech explains new research in plain language. This article was drafted with AI assistance and checked by a human against the original source.