Certificate Topics — Cybersecurity Foundations (Year 1 Foundations)

School: Minister Destiny Testimony Schools Track: Law Enforcement Class: Certificate Topics — Year 1 (Foundations) · Home: Schools — Law Enforcement track Certificate behind this topic: "Cybersecurity Foundations" — LinkedIn Learning, earned by Minister Destiny Marie Morgan (May 28, 2025) — earned ×3, including accredited versions (PMI-accredited version) Founded and presented by: Minister Destiny Marie Morgan, Minister

This lesson is educational information from Minister Destiny Testimony Schools. It teaches the public body of knowledge in this subject — the same ground Minister Destiny studied for her certificate — in this school's own words. It is not the original course, it does not award the original credential, and it is not legal or medical advice. If you are in danger right now, call 911. It is community-designed training, not agency policy, and school completion is a school achievement only — not a law-enforcement rank, title, or credential.

Before you start

• This school never asks your name. Your progress is saved to your student record, so you can pick up on any device. If you pass this unit's quiz (80% or higher, retakes allowed), you earn a downloadable certificate with a blank line — you write your own name on it after you save it. Quiz answers are not shown; if you miss a question, re-read the lesson and try again.
• This is the ground-floor topic for the whole cybersecurity cluster. Minister Destiny earned this certificate three times, including an accredited version, because foundations are what every later topic — threats, careers, programs, cloud — quietly depends on.
• You do not need a technical background. If you can use email and a phone, you have enough to start here.

The lesson

Part 1. What Cybersecurity Is — and What It Protects

Cybersecurity is the practice of protecting people, information, and the systems that hold that information from theft, damage, misuse, and disruption. The systems are not only computers. They include phones, networks, cloud accounts, records databases, building systems, vehicles, and the people who use all of them. When a city office, a hospital, a school, or a family loses control of its information, the harm is real even if nothing physical was touched: money moves, private records spread, services stop.

Start by naming assets — the things worth protecting. An asset can be data (names, case notes, financial records, health information), a service (dispatch, email, a records system that must stay running), a device, an account, or a reputation. You cannot protect what you have not named, so every serious security effort begins with an honest inventory: What do we hold? Where does it live? Who needs it? What would it cost us — in money, safety, or trust — if it were stolen, changed, or unavailable?

That last question matters for law-enforcement learners especially. A patrol schedule, a witness list, or an evidence log is not “just data.” Its value comes from what an attacker could do with it and what the community loses if it cannot be trusted. Cybersecurity, at its foundation, is the discipline of protecting that trust.

Part 2. The CIA Triad — Confidentiality, Integrity, Availability

Security professionals organise almost everything they do around three goals, called the CIA triad. Confidentiality means information is seen only by people authorised to see it. Passwords, access controls, and encryption serve confidentiality. A leaked personnel file is a confidentiality failure. Integrity means information stays accurate and unaltered except by authorised change. If someone quietly edits a record, a price, or a log entry, integrity has failed — even if nothing was “stolen.” Checksums, audit logs, and careful permissions protect integrity. Availability means authorised people can reach the systems and information they need, when they need them. Ransomware that locks a records system is an availability attack, even before anyone asks whether data was also copied.

The three goals pull against each other, and good security balances them. Lock a file so tightly that the detective who needs it cannot open it during an emergency, and confidentiality has defeated availability. Make a system so open that anyone can edit it, and availability has defeated integrity. When you read about a security decision — a new login rule, a backup plan, a restriction — ask which leg of the triad it strengthens and which leg it strains. That one question explains most security choices you will ever meet.

Part 3. Threat, Vulnerability, and Risk — Three Words That Are Not Interchangeable

Confusing these three words causes most muddled security talk, so learn them separately. A threat is something or someone that could cause harm: a criminal group, a disgruntled insider, a flood in a server room, a piece of malicious software. A vulnerability is a weakness that a threat could use: unpatched software, a shared password, a propped-open door, an untrained new hire. Risk is what happens when the two meet — the likelihood that a threat will exploit a vulnerability, combined with the impact if it does.

The formula in plain language is: risk grows when a real threat meets a real weakness guarding something valuable. You cannot delete every threat, and you cannot fix every weakness at once. What you can do is prioritise: protect the most valuable assets against the most likely threats through the most fixable weaknesses first. A small office that patches its internet-facing software, turns on multi-factor authentication, and keeps tested backups has reduced its largest risks without buying anything exotic. Notice, too, that risk can be accepted, transferred, or reduced — but it should be chosen knowingly, in writing, by someone with the authority to choose it, never simply ignored and renamed “fine.”

Part 4. How Attacks Commonly Begin — an Overview

Most attacks are not movie scenes. They begin in ordinary ways. Phishing messages trick a person into clicking, opening, or handing over a password — still the most common front door. Malware — malicious software including ransomware and spyware — arrives through attachments, downloads, and compromised websites. Credential attacks guess, buy, or reuse stolen passwords; because people reuse passwords, one old breach can unlock many accounts. Unpatched vulnerabilities let attackers walk through flaws that the software maker already fixed — the fix existed, it simply was never installed. Social engineering manipulates trust directly, by phone or in person. And insider misuse, careless or deliberate, exposes information from inside the walls every outer defence was built around.

Attackers also chain steps: a phish steals a password, the password opens email, email resets other accounts, and the intruder moves quietly toward money or data. Defenders study this chain because breaking any one link can stop the whole sequence. That is why the basics in Part 5 are not “beginner material.” They are the links most often broken, at the lowest cost, by ordinary people doing ordinary things carefully.

Part 5. The Defence Basics Everyone Starts With

Four defences carry more weight than everything else combined. First, updates: install software and security patches promptly, because patches close vulnerabilities attackers are actively using. Second, strong authentication: long, unique passwords — ideally held in a password manager — plus multi-factor authentication (MFA), which requires a second proof (a code, an app approval, a key) beyond the password. MFA means a stolen password alone is no longer enough. Third, backups: keep copies of important data separate from the main system, and test restoring them. A backup you have never restored is a hope, not a backup. Backups are the difference between ransomware as an emergency and ransomware as a disaster. Fourth, least privilege: give every person and program only the access their work requires, and remove access when roles change. Least privilege limits how far one stolen account or one mistake can spread.

Around those four sit supporting habits: locking screens, encrypting sensitive data, separating important systems from general ones, logging what happens so problems can be seen, and having a written plan for the bad day — who decides, who communicates, what gets shut down first. None of this requires genius. It requires consistency, which is harder, and which is exactly why it is a discipline rather than a purchase.

Part 6. Security Is Everyone's Job

Tools do not click phishing links; people do. Tools do not hold doors for strangers, reuse passwords, or email records to the wrong address; people do. That is why every credible security framework treats people as part of the system, not as a problem outside it. The clerk who reports a strange email in five minutes may save an entire network. The supervisor who models screen-locking teaches it better than any poster. The agency or business where reporting a mistake brings help — not shame — learns about incidents while they are still small.

Your role, whatever your title, is the same short list: know what assets pass through your hands, use the basic defences without being chased, notice when something looks wrong, and report it fast through the channel your organisation gives you. Security teams exist to support that loop, not to replace it. Minister Destiny built this school on the belief that ordinary people, taught plainly and treated with respect, can carry serious knowledge. Cybersecurity foundations are where that belief meets the digital world: the ground is learnable, the vocabulary is learnable, and the habits protect your family and your community as surely as they protect an agency.

Words to know — Cybersecurity Foundations

• Asset — anything worth protecting: data, a system, a service, a device, an account, or a reputation.
• Confidentiality — keeping information visible only to people authorised to see it.
• Integrity — keeping information accurate and changed only in authorised ways.
• Availability — making sure authorised people can reach systems and information when they need them.
• Threat — a person, event, or thing that could cause harm, such as a criminal group or a flood.
• Vulnerability — a weakness a threat could use, such as unpatched software or a shared password.
• Risk — the likelihood a threat will exploit a vulnerability, combined with the impact if it does.
• Multi-factor authentication (MFA) — logging in with a password plus a second proof, such as a code or app approval.
• Least privilege — giving each person and program only the access their work requires, and no more.
• Patch — a software update that fixes a flaw, often a security flaw attackers are already using.

Myths vs facts — Cybersecurity Foundations

• Myth: Cybersecurity is the IT department's job. Fact: Tools matter, but most incidents begin with an everyday action — a click, a password, a report made or not made. Security is everyone's job.
• Myth: Strong security means buying expensive software. Fact: Updates, MFA, tested backups, and least privilege prevent or limit most common harm, and they cost discipline more than money.
• Myth: A threat and a vulnerability are the same thing. Fact: A threat is what could harm you; a vulnerability is the weakness it could use. Risk appears when the two meet over something valuable.
• Myth: If data wasn't stolen, there was no real breach of security. Fact: Altered records break integrity and locked systems break availability — both are serious failures even with nothing copied.
• Myth: Small organisations and ordinary people are not targets. Fact: Automated attacks scan everyone. Attackers look for easy weaknesses, not famous names.

Think it through — Cybersecurity Foundations

A small municipal office keeps its permit records on one shared computer. Everyone uses the same login, the software update prompt has been dismissed for months, and the only “backup” is a folder on the same machine. One morning a staff member opens an email attachment that looks like an invoice. By noon, the records are encrypted and a ransom note is on the screen.

Walk it through: (1) Name the assets from Part 1: the permit records, the service residents depend on, and the town's trust. (2) Map the failures to the CIA triad in Part 2: availability is gone (records locked), integrity is in doubt (were records changed before encryption?), and confidentiality is unknown (was anything copied?). (3) Separate threat, vulnerability, and risk as in Part 3: the threat is a ransomware operator; the vulnerabilities are the unpatched software, the shared login, and the same-machine backup; the risk was high because a valuable asset sat behind all three. (4) Apply Part 5: updates would likely have closed the entry flaw, MFA and individual accounts would have limited spread, least privilege would have shrunk what one login could reach, and a separate, tested backup would have turned the incident into a restore instead of a ransom decision.

Try this — Cybersecurity Foundations

• ☐ List five assets you personally handle — accounts, records, devices — and write what would happen if each were stolen, changed, or locked
• ☐ Turn on multi-factor authentication for your email account first, then your most important other account
• ☐ Check one device for pending software updates and install them; set updates to automatic where you can
• ☐ Make one backup of something you cannot replace, store it separately, and open one file from it to prove it works
• ☐ Review one shared account or shared password in your life and replace it with individual access or a unique password

Resources to keep — Cybersecurity Foundations

• Cybersecurity and Infrastructure Security Agency (CISA) — cisa.gov — free federal guidance, alerts, and Secure Our World basics for individuals and organisations.
• National Institute of Standards and Technology (NIST) — nist.gov — the Cybersecurity Framework and plain-language small-business security resources.
• National Cybersecurity Alliance — staysafeonline.org — practical habits for passwords, MFA, updates, and backups, written for non-specialists.
• Federal Trade Commission Consumer Advice — consumer.ftc.gov — protecting personal information from hackers and scammers, in plain language.

What you earned / what's next — Cybersecurity Foundations

✅ Cybersecurity Foundations complete (quiz score 80% or higher): You can name the assets in your care, explain the CIA triad, tell threat, vulnerability, and risk apart, and apply the four defence basics with confidence.

Your certificate

Minister Destiny Testimony Schools Certificate of Completion — Cybersecurity Foundations

This certificate is presented by Minister Destiny Marie Morgan, Minister

Awarded to: ______________________________ (write your name here after you download — your name is never collected or stored by this school)

Date completed: ______________

Congratulations. You now hold the map the rest of this field is drawn on — what we protect, why it matters, and the honest basics that actually work. Build on it. — Minister Destiny Marie Morgan

This is a certificate of educational completion from Minister Destiny Testimony Schools. It is not a state license, a government certification, or the original course credential. School rank and completion are school achievements only — not a law-enforcement rank, title, or credential.

What's next: Return to the Certificate Topics for your next Year 1 Foundations topic.

Sources

• Cybersecurity and Infrastructure Security Agency (CISA) — Cybersecurity and Infrastructure Security Agency (cisa.gov) — Secure Our World basics and ransomware guidance used for the defence basics.
• NIST Cybersecurity Framework and small-business resources — National Institute of Standards and Technology (nist.gov) — framework language for assets, risk, and protection.
• National Cybersecurity Alliance — National Cybersecurity Alliance (staysafeonline.org) — core habits: strong passwords, MFA, updates, and backups.
• Federal Trade Commission Consumer Advice — Federal Trade Commission (consumer.ftc.gov) — guidance on protecting personal information from hackers and scammers.

Course Record — Cybersecurity Foundations

• Learning outcomes: On completing this unit, the student can:
• define cybersecurity and identify assets worth protecting in a home, office, or agency setting
• explain confidentiality, integrity, and availability and map a real incident onto the triad
• distinguish threat, vulnerability, and risk and prioritise fixes by asset value and likelihood
• describe how common attacks begin, including phishing, malware, credential reuse, and unpatched flaws
• apply the four defence basics: updates, strong authentication with MFA, tested backups, and least privilege
• state their own role in reporting incidents quickly and without shame
• Study time: Approximately 1.5 hours — an estimate covering reading, activities, and the test. Students move at their own pace.
• Assessment: A 10-question test drawn only from this unit's lesson. 80% or higher passes and earns the unit certificate. Answers are not shown; your score is saved to your student record, and retakes are allowed.
• Level: Certificate Topics — Year 1 (Foundations) · Law Enforcement school · working rank on completion path: Freshman → Sophomore.
• Version: Version 1.0 — October 2026.

Minister Destiny Testimony Schools — Law Enforcement. Educational information only. Help lines: 911 for emergencies · 988 Suicide & Crisis Lifeline (call/text 988).