The previous part described how devices are built, connected, and made to store and send data, and every one of those connections is also a way in for someone who shouldn't have it. Cybersecurity is the work of protecting computing systems and the information in them, and it is easiest to understand as a model with a few parts: there are assets worth protecting, threats that might harm them, vulnerabilities that give those threats an opening, and safeguards that reduce the chance or the cost of harm. This part takes up those parts in turn. Section 0004.a starts with the assets and the attacks aimed at them, sorted by the route an attacker takes, whether through people, through malicious code, through the network, or through access someone already has. Section 0004.b describes what defenders are trying to preserve, summarized as confidentiality, integrity, and availability, and the physical, digital, and behavioral safeguards that preserve it. Because no safeguard is free, 0004.c analyzes the trade-offs involved in choosing one, against usability, privacy, performance, and cost. Section 0004.d looks closely at cryptography, the mathematical toolkit beneath many digital safeguards, including what it can and can't do. Section 0004.e turns to the weaknesses in software and devices that attacks exploit, many of which come from a program trusting input it shouldn't. The part ends in 0004.f with what happens when prevention fails, following the stages of incident response from preparation to the lessons learned afterward. Throughout, the same reasoning recurs: risk depends on both how likely a harm is and how bad it would be, and protection should be proportioned to it.