Protecting Digital Systems, Networks and Information: A Review of Cybersecurity Threats and Defensive Practices

Digital systems increasingly store personal, academic, financial and organizational information. Online learning platforms, cloud applications, mobile devices and connected networks improve access and efficiency, but they also create opportunities for unauthorized access, data manipulation and service disruption. Cybersecurity is the coordinated practice of protecting systems, networks, applications and information through prevention, detection, response and recovery. A common foundation for information security is the confidentiality, integrity and availability (CIA) triad. Confidentiality restricts information to authorized parties; integrity protects information from unauthorized or improper alteration; and availability ensures that systems and data remain accessible when required. A security failure may affect more than one property—for example, ransomware can make files unavailable and may also expose stolen data. This paper reviews the threats and controls introduced in the accompanying seminar presentation, with emphasis on practical measures rather than a claim that any one technology can eliminate cyber risk. NIST Cybersecurity Framework (CSF) 2.0 offers a risk-management structure that organizations can use to organize and communicate cybersecurity outcomes [1].

This is a narrative review based on selected authoritative technical guidance and incident advisories. The source set includes NIST’s Cybersecurity Framework 2.0 and Digital Identity Guidelines, CERT-In’s WannaCry advisory, and Microsoft’s technical account of the WannaCry outbreak [1]– [4]. These sources were selected because they describe security outcomes, identity controls and a documented realworld incident. The review groups the material into threats, defensive controls, incident lessons and implementation priorities. The review is not a systematic literature review and does not include a new dataset, penetration test, survey or quantitative comparison of products. Accordingly, statements are presented as a synthesis of published guidance and documented incident information; no original performance results are claimed.

A. Phishing and Social Engineering: Phishing messages impersonate trusted people or services to persuade recipients to reveal credentials, disclose sensitive information or open malicious links and attachments. Social engineering is broader and includes fraudulent support calls, impersonation and urgent requests designed to bypass normal checks. Warning signs include unexpected attachments, mismatched sender addresses, unusual payment instructions and pressure to act quickly. Users should verify requests through an independent, trusted channel rather than relying on the contact details in the suspicious message. B. Malware and Ransomware: Malware includes viruses, worms, trojans, spyware and ransomware. A virus typically attaches to a host file; a worm can spread between systems; a trojan disguises itself as legitimate software; spyware collects information covertly; and ransomware blocks access to data, often by encrypting files. Malware may arrive through malicious downloads, exploited vulnerabilities, email attachments or compromised credentials. Keeping software updated, limiting privileges, using reputable endpoint protection and maintaining isolated backups reduce the impact of infection. C. Password and Credential Attacks: Reused or weak passwords allow attackers to exploit leaked credentials, guessing or automated login attempts. Long, unique passwords and a password manager reduce reuse. Multifactor authentication (MFA) requires an additional authentication factor and can reduce the consequences of a stolen password. Stronger, phishing-resistant authentication should be considered for administrators and high-risk accounts. Authentication controls must be supported by secure account recovery and prompt removal of access when users leave an organization. D. Network and Availability Attacks: Attackers may exploit exposed services, insecure Wi-Fi, misconfigured devices or excessive network permissions. Denial-of-service attacks attempt to exhaust resources and interrupt legitimate access. Firewalls enforce traffic rules, while intrusion detection and prevention systems can identify or block suspicious activity. Network segmentation limits unnecessary communication between systems, reducing the chance that a compromise in one area spreads throughout the environment.

A. Risk Management and Governance: Security work should begin with an inventory of important systems, data and dependencies. Organizations can assess threats and business impact, assign responsibility, prioritize controls and review progress. NIST CSF 2.0 organizes outcomes into Govern, Identify, Protect, Detect, Respond and Recover functions [1]. These functions should be treated as connected activities rather than a one-time checklist. B. Access Control and Authentication: Apply least privilege so each user and service receives only the access needed for its tasks. Separate administrator accounts from everyday accounts, review permissions regularly and disable unused accounts. Use MFA for email, remote access, administrative functions and other important services. Authentication policy should follow current risk and applicable standards; NIST SP 800-63-4 provides guidance on identity proofing, authentication and federation [2]. C. Encryption and Data Protection: Encryption transforms readable plaintext into ciphertext using a cryptographic method and key. Decryption restores readable data for an authorized party. Properly configured encryption can protect information in transit and at rest, but it does not by itself prevent phishing, endpoint compromise or misuse by an authorized account. Organizations should protect cryptographic keys, use trusted protocols, classify sensitive data and avoid storing unnecessary information. D. Patch Management and Secure Configuration: Known software vulnerabilities are a common route to compromise. Organizations should maintain an asset inventory, monitor vendor advisories, test and deploy security updates according to risk, and replace unsupported systems where possible. Secure configuration includes disabling unnecessary services, changing default credentials, restricting remote access and reviewing firewall rules. Emergency procedures should exist for vulnerabilities that are actively exploited. E. Backups, Monitoring and Recovery: Backups should be regular, protected from routine user and administrator access, and tested by restoring data. At least one backup copy should be isolated or otherwise protected from compromise of the production environment. Centralized logging and monitoring can help detect suspicious activity, while a written incidentresponse plan defines reporting, containment, evidence preservation, communication and recovery responsibilities. Exercises help verify that the plan works in practice. F. Human Awareness: Technical controls are more effective when users know how to report suspicious activity. Short, recurring training should teach people to inspect links, verify unexpected requests, protect authentication codes and report mistakes quickly without fear of blame. Awareness should be reinforced by easy reporting channels and clear organizational procedures. V. CASE STUDY: WANNACRY RANSOMWARE The WannaCry outbreak in May 2017 demonstrated how an unpatched vulnerability can contribute to rapid malware spread. CERT-In reported that WannaCry encrypted files on affected Windows systems and spread using a vulnerability in the Server Message Block (SMB) implementation; its advisory recommended applying the relevant Microsoft security update [3]. Microsoft likewise noted that the malware targeted systems that had not applied the available patch [4]. The case illustrates several connected lessons. First, a security update has limited value if deployment is delayed or assets are unknown. Second, network exposure and insufficient segmentation can allow an incident to affect additional machines. Third, backups are valuable only if they are protected and restoration is possible. Finally, organizations need monitoring and an incident-response process to isolate affected systems, communicate with stakeholders and recover safely. The incident does not prove that patching alone prevents every ransomware attack; rather, it shows the importance of combining patch management with defense in depth.

A practical starting point for an educational institution or small organization is to implement controls in stages. In the first stage, identify critical systems, confirm who owns them, enable MFA on important accounts, remove default credentials and ensure current backups exist. In the second stage, establish a patch schedule, deploy endpoint protection, restrict administrative privileges and review exposed services. In the third stage, improve network segmentation, centralize important logs and document incident-response responsibilities. Finally, test restoration, conduct awareness sessions and review risks periodically. Priorities should reflect the sensitivity of data, likely threats, operational impact and available resources. Security measures should be documented, assigned to responsible people and checked regularly. Small organizations may begin with a focused set of high-value controls, but should avoid treating a single tool or one-time awareness session as a complete security program.

Emerging areas include AI-assisted threat detection, cloud security, Internet of Things (IoT) protection, Zero Trust architectures and stronger identity technologies. AI may help prioritize alerts and identify unusual patterns, but it can also produce false positives and requires reliable data, evaluation and human oversight. Zero Trust emphasizes continuous, context-aware access decisions rather than assuming that network location alone establishes trust. Future work could compare selected controls in a defined test environment, measure detection and recovery outcomes, or survey user awareness with appropriate consent and a documented method.

Cybersecurity is a continuing risk-management activity that protects the confidentiality, integrity and availability of digital information. Phishing, social engineering, malware, ransomware, credential attacks and network weaknesses require different but complementary defenses. This review finds that a practical security posture combines governance, least-privilege access, MFA, encryption, secure network design, timely patching, protected backups, monitoring and user awareness. The WannaCry incident highlights the consequences of failing to apply known security updates and prepare for recovery. Because no single control eliminates risk, organizations should implement layered safeguards, test them regularly and improve them as systems and threats change.

Although the controls discussed above are widely recommended, implementation can be difficult. Small institutions may have limited budgets, few dedicated security staff and incomplete inventories of computers, applications and data. Legacy systems may support essential operations but no longer receive security updates. In such situations, organizations should document the risk, isolate the system where possible, restrict access, monitor activity and establish a migration plan rather than leaving the exposure unmanaged. Prioritization helps ensure that the most critical weaknesses are addressed first. Another challenge is balancing security with usability. Excessive prompts, complicated password rules or unclear reporting procedures can encourage users to work around controls. Security requirements should be designed around real workflows and tested with the people who use them. For example, a password manager can make unique passwords practical, while single sign-on combined with MFA can reduce repeated logins without removing important protection. Administrative exceptions should be time-limited, approved and recorded. Cloud services and remote work also complicate the traditional network boundary. Data may be accessed from personal devices, home networks and third-party platforms. Organizations should identify which services hold sensitive data, configure access restrictions, review sharing permissions and ensure that service providers’ security responsibilities are understood. A virtual private network may protect traffic on a connection, but it does not make a compromised device trustworthy or replace endpoint security and strong authentication.

The reviewed sources support a defense-in-depth approach: governance sets priorities, asset identification makes risk visible, protective controls reduce exposure, monitoring supports detection, and response and recovery limit the duration and impact of incidents [1]. The controls are mutually reinforcing. MFA may prevent some account takeovers, but patching is still required to address vulnerable software. Encryption can protect stored files, but protected backups are needed to recover from destructive attacks. Awareness can reduce successful phishing, but email filtering and access controls remain important because users cannot identify every malicious message. The WannaCry case is particularly useful because it links a known technical weakness to organizational maintenance practices. The existence of a patch did not guarantee that every affected machine received it in time [3], [4]. This distinction between available security advice and implemented security controls is central to cybersecurity management. Organizations need asset ownership, change processes, exception handling and verification that updates were successfully applied. The same principle applies to backup testing, MFA deployment and incident-response exercises: a policy is not evidence that the control is operating effectively. A limitation of this review is that it summarizes a small set of authoritative publications and one major incident rather than exhaustively comparing academic studies or commercial products. It therefore cannot establish that one control is universally superior or quantify the reduction in risk. Future work should define a specific environment and research question, establish a baseline, document the test method, and evaluate measurable outcomes such as patch coverage, time to detect, time to contain and time to restore. Any such evaluation should be conducted ethically and without exposing real systems to unnecessary risk.

INSTITUTIONS A concise checklist can help a college or small institution translate guidance into routine work. First, maintain an inventory of servers, staff and student devices, network equipment, cloud services and critical data. Second, assign an owner to each important system and classify information according to sensitivity. Third, enable MFA for email, administrator accounts and remote access; remove unused accounts; and review access permissions at fixed intervals. Fourth, keep operating systems, browsers, applications and network devices updated, with a documented process for urgent security fixes. Fifth, configure firewalls and Wi-Fi securely, separate guest access from internal systems, and limit administrative interfaces to authorized networks. Sixth, protect important data with suitable encryption and avoid collecting or retaining data without a clear need. Seventh, keep multiple backup copies, protect at least one copy from routine modification, and perform restoration tests. Eighth, collect and review relevant logs, establish a simple process for reporting suspicious messages and lost devices, and record who must be contacted during an incident. Finally, conduct periodic awareness sessions and review the checklist after significant changes or incidents. The checklist is a starting point and should be adapted to institutional risk, applicable laws and available resources.

Cybersecurity monitoring should be proportionate to the risks being addressed and consistent with applicable law and institutional policy. Logs may contain usernames, IP addresses, device identifiers or other information that can reveal user behavior. Access to logs should therefore be restricted, retention periods defined and collection limited to legitimate security needs. Security testing should have written authorization, a defined scope and safeguards against disruption or disclosure of personal information. Incident handling should preserve relevant evidence while avoiding unnecessary access to users’ private data.

NIST CSF 2.0 provides an outcome-oriented structure for managing cybersecurity risk rather than prescribing one fixed technical solution [1]. This is useful because organizations differ in size, technology, regulatory obligations and risk tolerance. The framework encourages organizations to govern cybersecurity, understand their assets and risks, implement safeguards, detect events, respond to incidents and recover operations. For a college, this can translate into assigning responsibility for student information systems, identifying critical services such as identity management and learning platforms, defining acceptable recovery times, and checking whether controls are consistently applied. NIST Digital Identity Guidelines provide technical guidance for identity proofing, authentication and federation [2]. Identity controls are important because accounts often connect users to email, cloud storage, learning systems and administrative services. Authentication should be selected according to the impact of account compromise. A student account and a privileged administrator account do not necessarily require identical controls, but both should have secure recovery processes and protections against credential theft. Organizations should also monitor for unusual sign-ins and promptly revoke access when accounts are no longer needed. CERT-In’s advisory on WannaCry and Microsoft’s technical report describe the 2017 incident from complementary perspectives [3], [4]. The CERT-In advisory warned of ransomware exploiting a Windows SMB vulnerability and recommended applying the relevant security update. Microsoft similarly emphasized that systems without the available patch were exposed. Taken together, these sources show the value of timely vulnerability remediation and clear communication during a widespread incident. They also illustrate why technical advisories should be translated into operational tasks: identify affected assets, prioritize updates, verify deployment and document any systems that cannot be patched immediately. Across these sources, a common theme is that cybersecurity is a process rather than a product. A firewall, endpoint protection tool or backup system can contribute to risk reduction, but its value depends on configuration, maintenance and testing. Security governance must therefore include responsibility, evidence of implementation and periodic review. For example, an institution can measure patch coverage, the proportion of important accounts protected by MFA, successful backup restoration tests and the time required to respond to reported phishing. These operational measures do not prove that an organization is secure, but they can reveal gaps and support improvement. This review also distinguishes preventive controls from resilience measures. Prevention attempts to reduce the likelihood of compromise; detection aims to identify suspicious activity; response contains and investigates incidents; and recovery restores trusted services. Mature security planning includes all four. Since prevention cannot guarantee that every attack will fail, recovery plans should be prepared before an incident and tested under realistic conditions. Backups should be separated from normal user access, restoration instructions should be available, and decisions about communication and escalation should be agreed in advance.