## glossary
What is Information Security?
Information security is the set of practices, controls and technologies aimed at protecting data and systems against unauthorized access, improper modification, destruction or unavailability. It covers much more than tools: it involves processes, policies and people’s behavior.
That last point is decisive. Most successful incidents do not exploit a sophisticated technical flaw — they exploit a person, through phishing, a reused password or a careless configuration.
The CIA triad
Three properties organize the entire field:
- Confidentiality — only those with authorization can access the information.
- Integrity — the information is not altered improperly or undetectably.
- Availability — those entitled to access can do so whenever they need to.
The three are frequently in tension. Strong encryption protects confidentiality and can compromise availability if the key is lost. Backups increase availability and enlarge the exposure surface. Security is trade-off management, not the maximization of a single dimension.
The most common application threats
- SQL injection — unsanitized input alters the database query. Prevented with parameterized queries.
- XSS — a malicious script injected into a page executes in other users’ browsers.
- CSRF — the victim’s authenticated browser is tricked into performing an unwanted action.
- Exposed credentials — API keys and passwords committed to the repository, one of the most frequent failures.
- Vulnerable dependencies — third-party libraries with known, unpatched flaws.
- Social engineering — manipulating people; it bypasses any technical control.
// VULNERABLE — the input becomes part of the command
const query = "SELECT * FROM usuarios WHERE email = '" + email + "'";
// malicious input can return every user in the table
// SAFE — parameterized: the input never becomes a command
const query = 'SELECT * FROM usuarios WHERE email = $1';
await db.query(query, [email]);Defense principles
A few principles guide decisions better than lists of tools. Defense in depth: multiple layers, because one always fails. Least privilege: each user and service gets only the access strictly needed. Fail safe: on error, the system denies instead of allowing. And never trust input: always validate on the server — client-side validation is usability, not security.
Authentication and the Brazilian context
Passwords must be stored with hash functions designed for the job, such as bcrypt or Argon2 — never in plain text, and never with plain MD5 or SHA. Multi-factor authentication is the single highest-impact measure against credential theft, covered in MFA in practice. In Brazil, the LGPD (the country’s general data protection law, analogous to the GDPR) makes protecting personal data a legal obligation, with significant penalties. For the authorized offensive side, see what a pentest is.
## faq
Frequently asked questions
What is the difference between information security and cybersecurity?
Information security is broader and covers any form of information, including paper documents and conversations. Cybersecurity is the slice that deals with systems, networks and digital data. In everyday practice the terms are used interchangeably.
How do you store passwords securely?
Never in plain text and never with fast hashes like MD5 or SHA-1. Use functions designed for passwords, such as bcrypt, scrypt or Argon2, which are deliberately slow and apply a unique salt per user — making brute-force attacks unfeasible even if the database leaks.
Are small systems targets too?
Yes. Most attacks are automated and sweep the internet indiscriminately looking for vulnerable versions and default configurations. There is no target selection by relevance — being exposed and outdated is enough.