What is Cybersecurity and Ethical Hacking?

Why cybersecurity matters more than ever

Every day, the world runs more on digital systems — banking, healthcare, government, communication, business. And every one of those systems is a potential target. Cyber attacks cost the global economy trillions, breaches expose the personal data of millions, and the people who can protect systems are in enormous, growing demand. There's a well-documented global shortage of skilled cybersecurity professionals, which makes this one of the most secure, well-paid, and meaningful career paths in all of tech.

Cybersecurity is the practice of protecting systems, networks, and data from digital attacks. It's a defensive discipline at heart: keeping the bad actors out and the important things safe. But here's the key insight that shapes the whole field — to defend a system effectively, you must understand how it can be attacked. That's where ethical hacking comes in.

What is ethical hacking?

Ethical hacking (also called penetration testing) is the practice of legally and with permission testing systems to find security weaknesses before malicious attackers do. An ethical hacker uses the same techniques and tools as a criminal hacker, but with a crucial difference: they have explicit authorisation, and their goal is to fix vulnerabilities, not exploit them. They're hired by organisations to think like an attacker, find the holes, and report them so they can be patched.

Think of it like hiring a professional to test whether your locks can be picked — so you can install better locks before a burglar tries. Ethical hackers are the "good guys" who use offensive skills for defensive purposes. This course teaches you to understand attacks so you can defend against them, always within legal and ethical boundaries.

The absolute rule: authorisation and legality

This is the most important thing in the entire course, and it's non-negotiable: you must only ever test systems you own or have explicit, written permission to test. Hacking systems without authorisation is a serious crime, with severe legal consequences including imprisonment — regardless of intent. The line between an ethical hacker and a criminal is permission.

So how do you practise safely and legally? You have excellent options:

• Your own lab — set up virtual machines on your own computer to attack and defend (we'll discuss this).
• Deliberately vulnerable practice apps — purpose-built systems designed to be hacked legally for learning, like DVWA, OWASP Juice Shop, and others.
• Legal practice platforms — sites like TryHackMe and Hack The Box provide safe, legal environments full of challenges.
• CTF competitions — "Capture The Flag" contests where you legally solve security puzzles.

These give you everything you need to build real skills without ever touching a system you're not authorised to. Never apply these techniques to systems you don't own or have permission for. Treat this rule as sacred — your entire career and freedom depend on it.

The "hats": white, black, and grey

The security world uses colour-coded "hats" to describe hackers by their intent, a useful vocabulary:

• White hat — ethical hackers who work legally and with permission to improve security. The good guys, and what this course trains you toward.
• Black hat — criminal hackers who attack illegally for personal gain or harm. The bad guys.
• Grey hat — operate in between, sometimes testing systems without permission but without malicious intent. Legally risky and not recommended — even good intentions don't make unauthorised access legal.

This course is unequivocally about becoming a skilled, ethical white hat — using knowledge to protect, with permission and within the law.

The foundation: the CIA triad

At the heart of all cybersecurity is a simple but powerful framework called the CIA triad — the three goals of security. Everything in the field ultimately serves one of these:

• Confidentiality — keeping data secret and accessible only to authorised people. (Encryption, access controls, and passwords protect confidentiality.)
• Integrity — ensuring data isn't tampered with or altered improperly, so you can trust it's accurate and authentic.
• Availability — ensuring systems and data are accessible when legitimate users need them. (Attacks that knock services offline target availability.)

When you assess any security situation, you can ask: which part of the CIA triad is at risk? A leaked password threatens confidentiality; a manipulated record threatens integrity; a crashed server threatens availability. This simple lens organises the entire field and will guide you throughout this course. With the mindset, ethics, and foundations set, the next chapter examines how the internet works from a security perspective — because you can't secure what you don't understand.