In cybersecurity, there are things called threat actors, and they are different people/types of people that operate in the cybersecurity space. These threat actors are trying to commit malicious acts against people in cyberspace, and they use a variety of methods; examples include nation-states (government-backed operations), Internal threat actors (people already within the system), and Hacktivists (who promote a social, political, or ideological cause through hacking).
In cybersecurity, we don’t care why they want to gain access to information or systems; we want to stop them because our information could be vital. This leads to another part of cybersecurity: assessing the risk of information being compromised and the impact of the loss of said information’s confidentiality, because if hackers could exploit a system easily but only for information that has little value, like gaining access to folders that are meant to go public soon, then there is little point in trying to defend that information. However, if a hospital's cybersecurity is great in order to protect patients' sensitive information, then the threat is low with a high impact because it’s hard for hackers to get in, but if they do, the impact that it can cause is substantial.
Ultimately, the main goal of cybersecurity is CIA: Confidentiality, Integrity, and Availability. Where Confidentiality: Keep it Secret. Ensure only authorized people can see the data; Integrity: Keep it Correct, and ensure the data hasn't been tampered with or changed; and Availability: Keep it Ready, and ensure the data is accessible when needed.
However, with the growing advancements in technology for defenders, hackers can have a hard time trying to get their objective, so they resort to social engineering. Social engineering is, in a sense, hacking the induvidual; instead of hacking the computer, you trick the owner in order to get the information you need. The most common form is phishing emails, where fake emails that look trustworthy try to make you click a link or send information to them directly. Social engineering isn’t limeted to online spaces because they can also piggyback into a restricted area by saying they forgot their badge. Social engineers’ methods include: Creating Urgency and Scarcity to force a response, posing as an authoritative figure to make you listen, using fear and intimidation, or using quid pro quo to make you more inclined to help them.
These are just the basics of cybersecurity and is a summary of a superficial level to these topics; I reccomed you to learn more in order to protect you online space.
