AP^® Cybersecurity

THE BIG PICTURE. Unit 1 is about protecting yourself in everyday digital life. Its five official AP topics are social engineering (Topic 1.1), suspicious website logins (1.2), best practices for public networks (1.3), AI-based cybersecurity attacks (1.4), and leveraging AI in cyber defense (1.5). Each is a concrete personal skill: spotting a manipulative message, recognizing a password attack, staying safe on public Wi-Fi, and understanding how AI now works on both sides of an attack. The course's shared vocabulary, the CIA triad, AAA, the vulnerability/threat/risk relationship, the attack surface, and defense in depth, is the language every later unit reuses. Several of these (CIA, risk, defense in depth) are formalized in the CED as Cyber Foundations in Unit 2.1; authentication/authorization/accounting show up across later units, and attack surface is standard industry vocabulary. All are summarized below as course-wide background rather than as Unit 1's own tested content. On the exam those foundations are assessed across Units 2 to 5, while Unit 1 is tested through the five everyday-security topics. (You will also weigh the impact of cybersecurity on individuals, organizations, governments, and society, and operate within professional norms and laws.)

FOUNDATIONS (COURSE-WIDE BACKGROUND). The next five ideas are the shared language of the whole course. Several are formalized as Cyber Foundations in Unit 2.1, and the rest surface across later units; every Unit 1 scenario relies on them, so learn them first and treat them as background that recurs in every later unit. (Classifying adversaries by skill and motivation is different: it is Unit 1's own tested content, covered under Topic 1.3 below.)

Every security control you will ever study supports at least one of these three goals:

• Confidentiality: only authorized people, systems, or processes can access data. A system that lacks confidentiality is vulnerable to data theft or exposure. Example control: encryption.
• Integrity: data are accurate and trustworthy and have not been altered by an unauthorized party. A system that lacks integrity is vulnerable to data manipulation. Example control: hashing or checksums.
• Availability: data and services are accessible to authorized users when they are needed. A system that lacks availability may suffer unexpected downtime. Example threat: a denial-of-service (DoS) attack.

A useful habit: for any attack on the exam, ask which leg of the triad it breaks. Stealing a password file attacks confidentiality, defacing a webpage attacks integrity, and a flood of traffic that knocks a site offline attacks availability.

CIA describes the goals. AAA describes how systems control who gets in and what they do:

• Authentication: verifying that someone is who they claim to be. Factors are usually grouped as something you know (password), something you have (a phone or token), something you are (a fingerprint or face scan), and somewhere you are (a location factor).
• Authorization: deciding what an authenticated user is allowed to do. A logged-in user (authenticated) may still be denied access to admin settings (not authorized).
• Accounting: keeping records of what users do, usually in log files. Logs let defenders detect suspicious activity, often called indicators of compromise (IoCs), such as many failed logins in a short time, logins at unusual hours, or logins from unknown devices.

Multifactor authentication (MFA) combines two or more factor types so that a stolen password alone is not enough. MFA recurs as a defense in Topics 1.2 and 1.4, but it fails if the victim also hands over the one-time code.

These three words are easy to blur and the exam tests the distinction directly:

• A vulnerability is a weakness that could be exploited (an unpatched program, a weak password, an open port).
• A threat is anything that could exploit a vulnerability to cause harm (an adversary, malware, even a natural disaster).
• Risk occurs when a threat can exploit a vulnerability to compromise an asset. No vulnerability or no threat means no risk.

Risk is assessed by two factors: the likelihood that a vulnerability is exploited, and the severity (impact) of the damage if it is. Likelihood rises with the value of the target, how easy the vulnerability is to exploit, and the motivation and skill of likely adversaries. Severity is often measured in financial cost but also includes operational and reputational damage. A result can be quantitative (a numeric or monetary value, such as a $10,000 annual risk) or qualitative (low, medium, high, severe).

The attack surface is the total set of points where an adversary could try to get in: every login page, open port, exposed service, USB slot, and even every employee who could be socially engineered. Reducing the attack surface (closing unused ports, disabling unneeded services, removing default accounts) removes opportunities before an attack starts.

Because no single control is perfect, defenders use defense in depth, also called layered defense. Multiple independent controls are stacked so that if one fails, others still protect the asset. A laptop might be protected by a strong password, full-disk encryption, MFA, anti-malware, a firewall, and a written security policy all at once. Controls can be grouped:

• By goal: confidentiality, integrity, or availability.
• By type: physical (locks, fences, guards), technical (firewalls, encryption, anti-malware), or managerial (password policies, access reviews, incident response plans).
• By function: preventative (stop an attack, like a lock), detective (spot an attack, like an IDS or camera), or corrective (restore after an attack, like patching).

Cybersecurity affects four levels: individuals (identity theft, financial loss), organizations (breaches, downtime, reputational harm), governments (espionage, attacks on critical infrastructure), and society (erosion of trust, disinformation). Because professionals hold elevated permissions and access to sensitive data, the field is governed by professional norms (for example from organizations like ISC2) and by laws that regulate categories of data such as personally identifiable information (PII, including biometric data), protected health information (PHI), student education records, and financial records. Some data security is mandated by industry regulation, for example the Payment Card Industry Data Security Standard (PCI DSS) for credit card data.

OFFICIAL UNIT 1 TOPICS. The five topics below are what the AP Exam actually assesses for this unit. They are everyday-security skills, not abstract theory.

SOCIAL ENGINEERING (Topic 1.1).

Social engineering uses psychological tactics to manipulate a person into revealing sensitive information (called elicitation), downloading a malicious file, or clicking a malicious link. It can happen in person but more often arrives by email, text message, or social media. The CED highlights two pressure tactics: intimidation (threatening negative consequences if the target does not comply, like a fake warning that an account will be closed) and urgency (pressuring the target to act immediately, before they can stop and think). Both exploit normal human responses. The CED names three impacts for victims:

• They may hand over personal information (name, phone number, address, workplace, pets' names, birthdate) that doubles as the answers to account challenge questions.
• They may give up secure information like a one-time password (OTP) or login code, letting the adversary log in as them.
• They may download malware, or click a link that installs it, which can steal browser data or send them to a fake page that captures their credentials.

The defense is to slow down, verify the request through a separate channel, and never share an OTP.

SUSPICIOUS WEBSITE LOGINS (Topic 1.2).

In an online password attack, an adversary repeatedly tries to log in using common passwords, common patterns, or stolen passwords. Three signs the CED wants you to recognize: many failed login attempts in a short time, logins at unusual times, and logins from unknown devices. Weak passwords make this easy because people reuse predictable patterns: a word or two plus a two-digit year and a special character, family or pet names, or personally meaningful dates. Adversaries build a dictionary from personal details about a target and feed it to an automated tool. To make authentication stronger: keep passwords long, random, and unique (a password manager generates and stores them, or use long passphrases), avoid names, dates, and meaningful words, and enable MFA so a stolen password alone is not enough.

WHY SOME PASSWORDS FALL FAST

BEST PRACTICES FOR PUBLIC NETWORKS (Topic 1.3).

Topic 1.3 opens by asking you to identify the type of adversary behind an attack. Adversaries are classified by skill level:

• Low-skilled adversaries rely on malicious tools built by others and bought online; those tools exploit already-known vulnerabilities.
• High-skilled adversaries can build new tools or modify existing ones to get around new defenses, and can discover undocumented vulnerabilities, called zero days.

They are also classified by motivation: greed (financial gain), desire for recognition, dedication to a cause, revenge, politics, or beliefs. Motivation explains target choice: someone dedicated to a cause may deface a high-profile webpage for no financial gain at all, simply to raise awareness.

Three wireless attacks:

• Evil twin: the adversary stands up their own wireless access point with an SSID similar or identical to a real network. Victims connect to the fake one and the adversary captures their traffic, though the adversary still cannot read traffic protected by an encrypted protocol like HTTPS.
• Jamming: flooding the area with a strong electromagnetic signal on the network's frequency, blocking legitimate traffic. Because it denies access, it is a form of denial-of-service (DoS) attack.
• War driving: driving or walking around to detect wireless beacons, learn what kind of network is in use, and find where its signal leaks outside the building.

Protections: verify the network name exactly matches the one you intend to join (the simplest defense against an evil twin); use a VPN, which encrypts your traffic to the VPN operator and hides it from your internet provider, but remember the VPN provider itself can view that traffic, so it is not blanket privacy; and because most internet protocols are already encrypted, weigh the sensitivity of your data before joining an unencrypted Wi-Fi network, since some traffic such as DNS queries can still be exposed.

AI-BASED CYBERSECURITY ATTACKS (Topic 1.4).

Adversaries now augment attacks with AI:

• Voice and image cloning: using samples to build a digital avatar that impersonates someone on a call or video, causing financial loss or leaked information, a growing threat as voice-based authentication spreads.
• AI-written phishing: large language models craft convincing messages in any language, erasing the "unnatural language" tell that used to flag phishing from non-native speakers.
• Prompt extraction: crafting prompts that pull secure or sensitive information out of an LLM, which can come from other users' input or the model's training data.
• Poisoned training data: publishing or editing websites with false information so it is pulled into LLM training sets, making the model repeat the falsehoods.
• AI reconnaissance: AI tools scan the internet, social media, and public sites to gather information about a target.
• AI-assisted code and malware: AI coding tools help write new malware, modify existing code for malicious ends, or find vulnerabilities in large code bases.

Defenses the CED names: agree on a shared secret word or phrase with close contacts to verify identity in high-stakes moments; enable MFA so a cloned voice alone cannot log in; never enter personal or sensitive data into AI tools, since some feed input back into training; and carefully verify AI output against reputable, non-AI sources.

LEVERAGING AI IN CYBER DEFENSE (Topic 1.5).

Defenders use AI too. When AI recommends a change, a knowledgeable person reviews it first:

• AI can review security configurations (firewall rules, access controls) and suggest more secure options, checked by a security technician.
• AI can analyze application code for vulnerabilities and recommend fixes, reviewed by a programmer.
• AI can suggest detection rules for automated systems, reviewed by a detection engineer.
• Because millions of events happen on a network daily and humans cannot examine them all, AI can be trained to triage events, sorting likely-malicious activity from harmless noise for faster, more accurate detection.
• AI tools can be programmed to alert human cybersecurity personnel when likely-malicious activity is detected, or to take specific corrective actions automatically based on the type of activity, so response teams can intervene quickly and prevent loss, harm, and damage.

The throughline: AI speeds up both detection and response. Its recommended changes to configurations, code, and detection rules are checked by a knowledgeable person before they go live, while alerting and some corrective actions can run automatically.

EXAM CONNECTIONS. Unit 1's own tested skills are practical: spotting social engineering tactics (intimidation, urgency) in a message or call, recognizing the signs of an online password attack in a login record, identifying wireless attacks (evil twin, jamming, war driving), identifying the type of adversary by skill level and motivation, and explaining AI-augmented attacks and AI-powered defenses. Scenario-style questions (a phishing email, a login log, a fake coffee-shop Wi-Fi) ask you to spot the indicators and choose the best protection, which is very often MFA, a password manager, never sharing an OTP, or simply verifying a network name. The course-wide foundations above (CIA, vulnerability/threat/risk, defense in depth) are assessed through Units 2 to 5, but learning them now pays off: threat plus vulnerability against an asset equals risk, and every control you propose should reduce either the likelihood or the impact of that risk.