Security work starts with a simple question: what are we protecting, and from what? The most widely used framework for the first half of that question is the CIA triad.
- Confidentiality: only authorized people can see the information. A leaked customer database is a confidentiality failure.
- Integrity: information and systems are accurate and have not been altered without authorization. A tampered invoice with changed bank details is an integrity failure.
- Availability: systems and data are there when needed. Ransomware that locks every file, or a flood of traffic that takes a website down, is an availability failure.
Almost every security control protects one or more of the three. Encryption mainly protects confidentiality. Hashes and digital signatures help detect integrity changes. Backups and redundancy protect availability. Learning to ask “which of the three does this affect?” makes incidents and controls much easier to reason about.
Risk in one sentence
Risk combines how likely something is to happen with how bad it would be if it did. Security people break that down into:
- Asset: something of value (customer data, the payroll system, the company’s reputation).
- Threat: something that could cause harm (a criminal group, a careless insider, a flood).
- Vulnerability: a weakness the threat could exploit (an unpatched server, a reused password).
- Control: a measure that reduces likelihood or impact (patching, multi-factor authentication, backups).
No organization can remove all risk. The aim is to reduce the most important risks to a level the organization accepts, and to know which risks remain.
Try this
Pick an organization you know, such as an employer, a club or your own household. List three assets, one realistic threat to each, a vulnerability that threat could use, and which part of the CIA triad would be hurt. Keep the list; you will add controls to it later in the course.