What is information security?

Security is a decision, not a product

Information security is often pictured as firewalls and hackers in hoodies. In practice it is something much closer to home. It is a set of small, everyday decisions about your information: who is allowed to see it, who is allowed to change it, and whether it is there when you need it.

You already make these decisions offline. You lock the front door, you keep your ID in your wallet, you leave a spare key only with someone you trust. Information security is that same instinct, applied to the digital world.

The three questions security asks

Every security decision comes back to three simple questions:

• Who should be able to see this?
• Who should be able to change this?
• Will it be here when I need it?

These three questions are known as confidentiality, integrity, and availability; the next lesson looks at them closely. For now, notice that most real incidents are just one of these three going wrong.

It is not just the IT team's job

The most common way information leaks has nothing to do with breaking through technology. It is a person being tricked, rushed, or simply unaware: a password reused across sites, a link clicked in a hurry, a laptop left unlocked.

That is good news. It means you are not powerless. The habits in this course are simple, and they are exactly the ones attackers hope you never build.