Introduction
Software is the set of programs, instructions, and data that tell computers and other digital devices what to do. It includes operating systems, mobile apps, web browsers, games, databases, cloud services, and the programs running inside devices such as cars and smart appliances.
Cybersecurity protects digital systems, software, networks, accounts, and information from unauthorized access, damage, disruption, or misuse. Modern security is not a single product. It combines secure software design, authentication, encryption, updates, backups, monitoring, user awareness, and risk management.
NIST's Cybersecurity Framework 2.0 organizes cybersecurity risk management around six broad functions: Govern, Identify, Protect, Detect, Respond, and Recover.
Learning Objectives
After studying this guide, you should be able to:
Distinguish system software, application software, and utilities.
Explain source code, programming languages, compilers, APIs, and software updates.
Define threats, vulnerabilities, exploits, and cybersecurity risk.
Explain confidentiality, integrity, availability, authentication, and authorization.
Recognize malware, phishing, ransomware, and other common security threats.
Understand encryption, hashing, MFA, backups, least privilege, zero trust, and secure software development.
What Is Software?
Software consists of instructions executed by computing hardware.
The major categories are:
System Software
System software manages hardware and provides a platform for other programs.
Examples include:
Operating systems
Device drivers
Firmware
System utilities
Application Software
Application software performs tasks for users.
Examples include:
Word processors
Web browsers
Games
Messaging apps
Accounting programs
Video editors
Utility Software
Utilities perform maintenance or support functions.
Examples may include:
Backup programs
File-management tools
Disk utilities
Security scanners
Memory Tip
System software → runs the computer
Application software → helps the user perform tasks
Operating Systems
An operating system (OS) manages computer resources and provides services to applications.
Its responsibilities commonly include:
Memory management
File management
Process scheduling
User accounts
Hardware communication
Security controls
Examples include Windows, macOS, Linux, Android, and iOS.
Source Code and Machine Code
Programmers normally write software as source code using programming languages.
Processors ultimately execute lower-level machine instructions.
Software-development tools convert human-readable source code into instructions a computer can execute.
Compiler vs Interpreter
A compiler translates source code into another form, often producing executable machine code or intermediate code before the program runs.
An interpreter executes or processes program instructions during runtime.
Modern programming environments sometimes combine compilation and interpretation, so the distinction is not always absolute.
Programming Languages
Programming languages provide structured ways to express algorithms and software behavior.
Examples include:
C
C++
Java
Python
JavaScript
Rust
Go
Different languages are suited to different purposes.
For example, some emphasize systems programming, while others are widely used for web development, automation, scientific computing, or application development.
Algorithms
An algorithm is a defined sequence of steps for solving a problem or completing a task.
A simple algorithm might:
Receive input.
Process the data.
Make a decision.
Produce output.
Algorithms are not limited to one programming language.
APIs
An Application Programming Interface (API) allows software components to communicate through defined rules.
For example, an application might use an API to:
Request weather data.
Process a payment.
Access a database.
Use a mapping service.
An API provides an interface without requiring every program to know the internal design of another system.
Databases
A database stores organized information so that software can retrieve and update it efficiently.
Examples of stored data include:
Customer accounts
Product inventories
School records
Financial transactions
A Database Management System (DBMS) is software used to create, organize, query, and manage databases.
Cloud Computing
Cloud computing provides computing resources through remote infrastructure rather than relying entirely on a user's local machine.
Cloud services may provide:
Storage
Applications
Databases
Servers
Computing power
Cloud computing changes where resources operate, but it does not remove the need for cybersecurity.
Open-Source and Proprietary Software
Open-source software makes its source code available under a license that permits specified forms of inspection, modification, or redistribution.
Proprietary software is controlled under licenses that generally restrict source-code access or modification.
Neither category is automatically secure or insecure. Security depends on design, implementation, maintenance, configuration, and vulnerability management.
Software Versions and Updates
Software changes over time through:
Updates
Patches
New releases
Security fixes
A patch is a software change intended to correct a problem.
Security patches commonly address vulnerabilities discovered after software has been released.
Keeping software updated is an important defensive practice because attackers frequently target known weaknesses in outdated systems. CISA includes software updates among its basic public cybersecurity recommendations.
Cybersecurity Fundamentals
Cybersecurity aims to manage risks involving computers, software, networks, and information.
Important questions include:
Who should have access?
Is information accurate?
Are systems available when needed?
Can attacks be detected?
Can operations recover after an incident?
The CIA Triad
A classic security model uses three goals:
Confidentiality
Confidentiality means information is accessible only to authorized people or systems.
Examples include protecting:
Passwords
Medical records
Financial data
Integrity
Integrity means data remains accurate and has not been improperly changed.
For example, a banking system must prevent unauthorized alteration of account balances.
Availability
Availability means systems and information remain accessible when authorized users need them.
A service outage can therefore be a security problem even when no information is stolen.
Memory Tip
C → Confidentiality
I → Integrity
A → Availability
Threat, Vulnerability, Exploit, and Risk
These terms describe different concepts.
Threat
A threat is something capable of causing harm.
Examples include:
Criminal attackers
Malicious insiders
Malware
Accidental mistakes
Natural disasters
Vulnerability
A vulnerability is a weakness that could be used or triggered to cause harm.
Examples include:
Programming errors
Weak configurations
Missing security updates
Exploit
An exploit is a method or technique that takes advantage of a vulnerability.
Risk
Risk combines ideas such as:
Likelihood
Vulnerability
Threat
Potential impact
Security aims to reduce risk rather than claim that every threat can be eliminated.
Authentication and Authorization
These two terms are easily confused.
Authentication
Authentication answers:
Who are you?
Examples include verification using:
Passwords
Security keys
Authenticator apps
Biometrics
Authorization
Authorization answers:
What are you allowed to do?
A user may successfully log in but still lack permission to access administrative settings.
Memory Tip
Authentication → identity
Authorization → permission
Multi-Factor Authentication
Multi-factor authentication (MFA) requires more than one type of authentication evidence.
Factors may involve:
Something you know
Something you have
Something you are
For example, an account might require both a password and a security key.
CISA recommends enabling MFA because compromising a password alone may then be insufficient to access an account.
NIST's current Digital Identity Guidelines, finalized in 2025, provide updated standards for authentication and authenticator management.
Least Privilege
The principle of least privilege means users and programs should receive only the permissions required to perform their legitimate tasks.
For example:
A normal employee account usually does not need full system-administrator privileges.
Reducing unnecessary permissions limits the damage that can occur if an account or application is compromised.
Encryption
Encryption transforms readable information into a protected form using cryptographic techniques.
Authorized users with the correct cryptographic key can recover the original data.
Encryption is widely used to protect:
Web traffic
Stored files
Communications
Financial transactions
NIST describes cryptography as the use of mathematical techniques to protect information and supports standards for encryption, digital signatures, hashing, and key management.
Hashing
A cryptographic hash function converts input data into a fixed-size output called a hash or digest.
Hashing differs from encryption because it is intended to be one-way rather than reversible.
Hashes can help with:
Integrity checking
Digital signatures
Secure password-storage systems
NIST defines hashing as applying an algorithm to data to produce a representative digest.
Encryption vs Hashing
Encryption → designed to be reversed with the proper key
Hashing → designed as a one-way transformation
Firewalls
A firewall controls network traffic according to defined security rules.
It can help restrict unwanted communication between:
Devices
Networks
Applications
A firewall is useful, but it cannot replace secure software, authentication, updates, or safe user behavior.
Malware
Malware means malicious software.
Several major types exist.
Virus
A computer virus attaches itself to files or programs and can spread when infected content is executed.
Worm
A worm is designed to spread between systems, often with less user involvement than a traditional virus.
Trojan
A Trojan disguises malicious behavior behind apparently legitimate software or content.
Spyware
Spyware secretly collects information about a user or system.
Ransomware
Ransomware attempts to deny access to systems or data, often through encryption, and demands payment or another action from the victim.
Common Mistake
Malware is the broad category.
A virus is only one type of malware.
Phishing and Social Engineering
Social engineering manipulates people rather than relying only on technical weaknesses.
Phishing commonly involves messages or websites pretending to be trustworthy in order to steal information, obtain account access, or persuade a person to install malicious software.
Common warning signs can include:
Unexpected requests
Suspicious links
Unusual attachments
Pressure to act immediately
Requests for credentials
Phishing may occur through email, text messages, websites, or voice communication.
Backups
A backup is a separate copy of important information that can be used for recovery.
Backups can protect against:
Hardware failure
Accidental deletion
Data corruption
Some ransomware incidents
A backup should not be treated as useful merely because it exists. Organizations need to know that backup data can actually be restored.
Software Security
Cybersecurity should begin during software design rather than being added only after software is finished.
NIST's Secure Software Development Framework recommends integrating security practices throughout the software development life cycle to reduce vulnerabilities and their potential impact.
CISA similarly promotes Secure by Design, arguing that manufacturers should make customer security a core requirement from the design and development stages onward.
Secure Software Development Life Cycle
Security activities may occur during:
Planning → Design → Coding → Testing → Deployment → Maintenance
Examples include:
Defining security requirements
Reviewing software design
Testing code
Managing dependencies
Fixing vulnerabilities
Protecting development systems
Monitoring released products
OWASP Top 10
The OWASP Top 10 is an awareness document describing important web-application security risk categories.
The current OWASP Top 10:2025 includes:
Rank | Risk Category |
A01 | Broken Access Control |
A02 | Security Misconfiguration |
A03 | Software Supply Chain Failures |
A04 | Cryptographic Failures |
A05 | Injection |
A06 | Insecure Design |
A07 | Authentication Failures |
A08 | Software or Data Integrity Failures |
A09 | Security Logging and Alerting Failures |
A10 | Mishandling of Exceptional Conditions |
These categories are intended to improve awareness and secure development rather than describe every possible software vulnerability.
Software Supply Chain Security
Modern programs often depend on:
External libraries
Development tools
Cloud services
Package repositories
Third-party components
A software supply chain includes the people, systems, tools, and components involved in producing and delivering software.
A weakness in one dependency can potentially affect many applications that rely on it.
This is one reason secure development now includes management of third-party components and dependencies.
Security Logging and Monitoring
Logs record events occurring within software and systems.
Examples include:
Login attempts
Configuration changes
Errors
Administrative actions
Monitoring helps organizations notice suspicious activity and investigate incidents.
A system that blocks some attacks but records nothing about them can make investigation and recovery much harder.
Zero Trust
Zero trust is a security approach that does not automatically trust a user or device merely because it is inside a particular network.
NIST describes zero trust as focusing protection on users, assets, and resources while avoiding implicit trust based only on network location or ownership.
Zero trust commonly emphasizes:
Authentication
Authorization
Device security
Least privilege
Continuous evaluation
Common Mistake
Zero trust does not mean that nobody is ever trusted.
It means trust should be established and limited according to verified conditions rather than automatically assumed.
Cybersecurity Framework 2.0
NIST CSF 2.0 uses six functions:
Govern → Identify → Protect → Detect → Respond → Recover
Govern
Establish cybersecurity responsibilities, policies, and risk strategy.
Identify
Understand assets, systems, dependencies, and risks.
Protect
Apply safeguards to reduce cybersecurity risk.
Detect
Find and analyze possible cybersecurity events.
Respond
Take action during a cybersecurity incident.
Recover
Restore capabilities and improve resilience afterward.
CSF 2.0 is designed for organizations of different sectors, sizes, and maturity levels rather than only critical infrastructure.
Security vs Privacy
Security and privacy overlap but are not identical.
Security focuses on protecting information and systems from unauthorized access or harm.
Privacy concerns appropriate collection, use, sharing, and control of personal information.
A database could be technically secure from attackers while still raising privacy concerns if it collects unnecessary personal data.
Common Mistakes
Software and Hardware Are Different
Hardware → physical components
Software → programs and instructions
Authentication and Authorization Are Different
Authentication verifies identity.
Authorization determines permissions.
Encryption and Hashing Are Different
Encryption is reversible with the correct key.
Cryptographic hashing is designed to be one-way.
Malware and Virus Are Not Synonyms
A virus is one type of malware.
A Firewall Does Not Provide Complete Security
Security requires multiple layers.
Updates Are Not Only About New Features
Many updates repair security vulnerabilities.
Open Source Does Not Automatically Mean Insecure
Security depends on how software is designed, reviewed, configured, and maintained.
Strong Security Is Not Only the User's Responsibility
Secure-by-design approaches emphasize that software manufacturers should build security into products rather than transferring the entire burden to customers.
Memory Tips
For software:
OS → manages system
App → performs user task
API → software communication
Patch → fixes or updates
For security:
CIA → Confidentiality, Integrity, Availability
Authentication → who
Authorization → what
Encryption → reversible with key
Hashing → one-way digest
For threats:
Virus → infects files
Worm → spreads
Trojan → disguises
Ransomware → denies access
Phishing → deceptive message
For NIST CSF:
Govern → Identify → Protect → Detect → Respond → Recover
Summary
Software includes system software, applications, utilities, source code, APIs, databases, and cloud services. Operating systems manage hardware resources, while applications perform tasks for users.
Cybersecurity protects systems and information against unauthorized access, alteration, disruption, and other harm. The CIA triad summarizes three fundamental goals: confidentiality, integrity, and availability.
Authentication verifies identity, while authorization controls permissions. MFA adds additional authentication factors, least privilege reduces unnecessary access, encryption protects readable data, and hashing produces one-way digests.
Major threats include malware, ransomware, phishing, vulnerable software, insecure configurations, and compromised dependencies. Updates, backups, monitoring, secure defaults, and careful access control reduce risk.
Modern cybersecurity increasingly emphasizes building security into software throughout development. NIST's Secure Software Development Framework, CISA's Secure by Design approach, OWASP's application-security guidance, and the NIST Cybersecurity Framework provide widely used models for improving software and organizational security.
FAQ
What is software?
Software is the collection of programs, instructions, and data used by computers and digital devices.
What is an operating system?
An operating system manages hardware resources and provides services that applications use.
What is cybersecurity?
Cybersecurity is the protection of digital systems, networks, software, accounts, and information from unauthorized access, disruption, damage, or misuse.
What does CIA mean in cybersecurity?
Confidentiality, Integrity, and Availability.
What is the difference between authentication and authorization?
Authentication verifies identity. Authorization determines what an authenticated user is allowed to access or do.
What is MFA?
Multi-factor authentication requires more than one type of authentication evidence, making account compromise more difficult.
What is malware?
Malware is malicious software. Viruses, worms, Trojans, spyware, and ransomware are examples.
What is phishing?
Phishing is a social-engineering technique in which an attacker impersonates a trusted source to obtain information, access, or harmful user actions.
What is the difference between encryption and hashing?
Encryption protects information in a form that can be decrypted with the correct key. Hashing produces a one-way digest used for purposes such as integrity verification.
What is zero trust?
Zero trust avoids granting implicit trust merely because a user or device is inside a particular network and instead emphasizes verification and controlled access to resources.
Key Takeaways
Software includes operating systems, applications, utilities, APIs, databases, and the code from which programs are built.
Confidentiality, integrity, and availability are three fundamental cybersecurity objectives.
Authentication verifies identity, authorization controls permissions, and MFA adds additional protection to accounts.
Malware, phishing, insecure configurations, vulnerable software, and supply-chain weaknesses are major security risks.
Secure software development builds protection into the development lifecycle instead of relying only on patches after problems appear.
References
NIST — Cybersecurity Framework 2.0 Official framework for cybersecurity risk management organized around Govern, Identify, Protect, Detect, Respond, and Recover.
NIST — Cybersecurity FrameworkNIST — Secure Software Development Framework (SSDF) Official guidance for integrating security practices into software development and reducing vulnerabilities.
NIST — Secure Software Development FrameworkNIST — Digital Identity Guidelines: Authentication and Authenticator Management Current NIST guidance on authentication, passwords, authenticators, and assurance levels.
NIST — SP 800-63B-4NIST — Zero Trust Architecture Authoritative description of zero-trust principles, identity verification, resource protection, and access control.
NIST — Zero Trust ArchitectureNIST — Cryptography Overview of encryption, hash functions, digital signatures, key management, and cryptographic standards.
NIST — CryptographyCISA — Secure Our World Public cybersecurity guidance covering phishing, passwords, multifactor authentication, and software updates.
CISA — Secure Our WorldCISA — Secure by Design Guidance encouraging technology manufacturers to make security a core part of software design, development, and deployment.
CISA — Secure by DesignOWASP — Top 10:2025 Current OWASP awareness document covering major web-application security risk categories.
OWASP — Top 10:2025