Intro to Cybersecurity · How hackers think and act · Day 1 of 4
Intro to Cybersecurity and Your First Challenge
What cybersecurity really protects, how a website decides who to trust, and how an attacker thinks. Then you solve your first challenge on the AquilaCyber platform.
By the end of today you can
- Say in plain words what cybersecurity protects
- Explain how a website decides who to trust, and where that can go wrong
- Describe the attacker mindset without being an attacker
- Know what a CTF is and solve your first beginner challenge on AquilaCyber
Every time you log in, buy something, or open a link, a computer somewhere makes a quiet decision: should I trust this? Cybersecurity is the study of those decisions, and of what happens when they are made badly.
This course is called How hackers think and act. That is the point. You are not here to memorise tools. You are here to learn to look at an everyday system and ask the question an attacker asks: what is this thing quietly assuming, and what happens if that assumption is wrong?
Everything hands-on happens on AquilaCyber, our training platform. The systems there are built to be broken safely, for learning. You never practise on anything that is not yours.
1. What Cybersecurity Protects
Definition
Cybersecurity is the practice of keeping information and systems safe from people who should not reach them, change them, or shut them down.
That sentence hides three different jobs. Security people call them the CIA triad. It has nothing to do with the agency. It is three promises a good system keeps.
Real-Life Scenario
Think about your results on a learning platform like Webbo3.
- Confidentiality means only you and your tutor can see your score. A stranger cannot.
- Integrity means nobody can quietly change your 48 into a 98.
- Availability means the results page is actually up when you go to check it.
Break any one of those and the system has failed, even if the other two are perfect. A grade nobody can trust is as useless as a grade nobody can see.
| The promise | In plain words | How it gets broken |
|---|---|---|
| Confidentiality | Secrets stay secret | Someone reads data meant for others |
| Integrity | Data stays true | Someone changes data they should not |
| Availability | The service stays up | Someone takes the service down |
2. How a Website Decides Who to Trust
Definition
Before a website shows you anything private, it answers two questions in order.
- Authentication:
who are you?You prove it with a password, a code, a fingerprint. - Authorization:
what are you allowed to do?Being logged in as a student does not make you a tutor.
Beginners mix these two up constantly, so hold on to the difference. Authentication is the bouncer checking your name is on the list. Authorization is the bouncer knowing that your wristband gets you into the hall but not into the back office.
Where It Goes Wrong
A system is only as honest as the questions it actually asks. Imagine a results page whose address looks like this.
The address bar of a logged-in student
The site authenticated you: it knows you logged in. But what if it never asks the second question? What if changing 3012 to another number just shows that person’s results, because the page trusts the number in the link instead of checking whose results you are allowed to see?
You did not hack anything clever. You noticed an assumption: the site assumed nobody would change the number. That is the whole mindset in one example. We fix this exact bug on the server in Day 2.
Hiding something, or politely asking people not to touch it, is not security. If the only thing stopping you from seeing another person’s results is that you did not think to change a number, the results were never protected.
3. The Attacker Mindset
Definition
The attacker mindset is a habit of looking at a system and asking what it takes for granted. Not "how do I break the rules", but "which rule did they forget to actually enforce".
Real-Life Scenario
A market stall offers "pay what the label says". Most people read the label and pay it. The person with the attacker mindset notices that nobody checks the label against the till, and wonders what stops a shopper writing their own label. A good stall owner thinks the same thought first, and puts a check in place. Same thought, opposite purpose.
In this course you practise that thought on purpose, in a safe place, so that when you build things later you spot the missing check before an attacker does.
A penetration tester is paid to break into a system with permission, then report exactly how, so it can be fixed. A criminal does the same thing without permission and keeps it secret. The skill is identical. Permission and intent are the entire difference, and they are the line you never cross.
4. What Is a CTF?
Definition
A CTF, short for Capture The Flag, is a game where you solve security puzzles. Each puzzle hides a short secret string called a flag. Find it, paste it in, score points.
A flag usually looks like this, so you know it when you see it.
What a flag looks like
CTFs are how almost every security professional started. They are safe, they are legal, and they are built to be broken. On AquilaCyber the challenges get harder as you go, and a leaderboard shows who has solved what.
Open the AquilaCyber platform your tutor shares and sign in.
Find the challenge marked Day 1: First Flag. Read it slowly, twice.
Before touching anything, write one sentence: what is this challenge assuming?
Solve it, and paste the flag. Expected: your name appears on the leaderboard with your first points.
You are looking at a login box. Most people see a wall. Today you learned to see a question the computer is asking: "who are you?" Tomorrow you learn why so many systems ask that question well, then forget to ask the second one.
Practise
- Say it back. In one sentence each, explain confidentiality, integrity and availability using your own example (not the results one).
- Spot the question. You log in to a food app and see your past orders. Which question did the app answer to show them: authentication, authorization, or both?
- Find the assumption. A cloakroom gives you ticket number 14 and hangs your coat on hook 14. What is it assuming, and how would an attacker abuse it?
- First flag. Solve Day 1: First Flag on AquilaCyber and note how long it took you to spot the assumption versus how long to find the flag.
Checkpoint
Is authentication the same as authorization?
No. Authentication proves who you are. Authorization decides what you are allowed to do. You can be perfectly authenticated and still not be authorized for a given action.
Why is changing a number in a link sometimes enough to see someone else’s data?
Because the site authenticated you but never checked whether you are allowed to see that particular record. It trusted the number instead of checking permission. The fix is a permission check on the server, which we build in Day 2.
Is it legal to practise these skills?
On systems you own or are given permission to test, like AquilaCyber, yes. On anything else, no. Permission is the line, and it never moves.
Tick Before You Move On
- ☐ I can explain what cybersecurity protects using the three promises
- ☐ I can tell authentication from authorization
- ☐ I can describe the attacker mindset in one sentence
- ☐ I solved Day 1: First Flag on AquilaCyber
Quick Recap
Cybersecurity keeps information and systems confidential, true and available. A website first asks who you are (authentication), then what you may do (authorization). Most beginner bugs are a forgotten second question: a missing permission check. The attacker mindset is spotting what a system assumes. A CTF is where you practise it safely.
Next: Day 2, where that forgotten permission check becomes a real challenge. You try an admin bypass on AquilaCyber and learn why the check has to live on the server.