← Back to catalogue
Research draft

computer security

vr.tr.computer-security · XCT.STA

Let an agent explain computer security concepts and practices, help people and organisations protect systems and respond to incidents, explain standards and law, and decline requests to attack or compromise systems without authorisation.

Thing Registry Cross-cutting context

Research draft, second pass

A second pass drafted this model: the structure a model of this thing needs, and what is known about it in the world. The line under this one says how the second half was obtained - researched against sources, or recalled without web access, in which case nothing here was read anywhere and every claim is a lead to verify. Unreviewed either way.

written by Claude from model knowledge without web access - no source was read, every claim is a lead to verify

Researched by: Claude

Purpose and description

Let an agent explain computer security concepts and practices, help people and organisations protect systems and respond to incidents, explain standards and law, and decline requests to attack or compromise systems without authorisation.

The protection of computer systems, networks, software and data from unauthorised access, damage, disruption and theft, through practices such as access control, encryption, patching, monitoring, secure design and user education, and disciplines including hardware security, internet safety and cyber resilience; it is governed by standards and law and practised defensively by organisations and individuals.

What it is for: Protecting systems and data.

It can be explain threats and defences; give practical security guidance; support incident response and reporting; explain standards and legal obligations.

Distinguishing features

Protects confidentiality, integrity and availability

Technical and human measures

Standards-based

Legally regulated

What it looks like

Not physical; practices, controls and policies.

How it is recognised

Defensive measures and controls

Standards and audits

Attacking systems without authorisation is a crime, not security

Related models

is a kind of - category

information security

is a kind of - category

security

protects - hardware

integrated circuit

is related to - systems protected

electronics

In practice

Families and kinds

network and internet security

application and software security

hardware security

identity and access management

cyber resilience and incident response

Standards and regulation

ISO/IEC 27001 and NIST Cybersecurity Framework

Data protection and breach notification laws

Computer misuse and cybercrime laws

Failure modes and hazards

Breaches and data loss

Facilitating attacks

Security theatre without real protection

Also called

cyber intelligencecyber resilienceinternet safetyhardware securityinternet securitycapability-based securityGroup-IB Threat IntelligenceGroup-IB Fraud ProtectionGroup-IB Managed eXtended Detection and ResponseGroup-IB Attack Surface ManagementGroup-IB Digital Risk ProtectionGroup-IB Business Email ProtectionGroup-IB Incident ResponseGroup-IB Digital ForensicsGroup-IB Cyber InvestigationsPsychology in cybersecuritycyber threat huntingkey expirationmobile securityUnix securitycomputer security modelsecurity operations centerprovable securitynetwork securitybrowser securityCapability-based addressingDHCP snooping

Where this came from

wikidata · CC0 1.0

Source repository Registry entry point

Drafted structure

Bundle to layer to finding to question, as the second pass will find it: 4 bundles · 8 layers · 8 findings · 16 questions.

Limits Agent conduct.

Defensive only.

Authorisation

Authorised work.

Authorisation

Authorisation.

  1. Is the request defensive, or does it seek to attack, access or disrupt systems without clear authorisation? boundary
  2. How should the agent decline unauthorised requests and support lawful security work? action

Incident

Active incidents.

Incident

Incidents.

  1. Is a breach or attack under way? boundary
  2. Which immediate containment steps and reporting duties apply? action
Protect Practical security.

Basics first.

Individuals

Personal security.

Individuals

Personal security.

  1. Which measures protect a person, such as strong authentication, updates and phishing awareness? provenance
  2. How can accounts be secured after compromise? action

Organisations

Organisational security.

Organisations

Organisational security.

  1. Which controls and frameworks should an organisation of this size adopt? provenance
  2. How are risks assessed? action
Threats Understanding threats.

Know the risks.

Types

Threat types.

Types

Threats.

  1. What are the main threat types, such as malware, phishing and ransomware, and how do defences address them? definition
  2. Which current advisories are relevant? provenance

Hardware

Hardware and supply chain.

Hardware

Hardware security.

  1. What is hardware security, and why do supply chains matter? definition
  2. Which standards apply? provenance
Govern Standards and law.

Compliance.

Standards

Frameworks.

Standards

Frameworks.

  1. Which security standards and certifications apply, and what do they require? provenance
  2. How is compliance audited? provenance

Law

Legal duties.

Law

Legal duties.

  1. Which breach notification, data protection and cybercrime laws apply here? provenance
  2. Where can incidents be reported? provenance

What the second pass must settle

  • Should each subfield be a separate entry?
  • How should advisories be linked?
  • How should legal obligations be localised?
Draft as JSON