Core ideas: CIA, risk, threats and vulnerabilities

Security professionals use a small set of concepts to reason about problems. Learning them helps you understand advice and ask the right questions.

The CIA triad

• Confidentiality: only authorised people can read information. A leaked customer database breaks confidentiality.
• Integrity: information is accurate and has not been changed without authorisation. A tampered bank account number on an invoice breaks integrity.
• Availability: information and systems are there when needed. Ransomware and denial of service attacks break availability.

Every security control protects one or more of these. Encryption protects confidentiality, digital signatures and change logs protect integrity, and backups and redundancy protect availability.

Assets, threats, vulnerabilities and risk

• Asset: something of value, such as customer data, a payment system or your email account.
• Threat: something that could cause harm, such as a criminal group, an insider or a flood.
• Vulnerability: a weakness a threat could exploit, such as an unpatched server, a reused password or an untrained employee.
• Risk: the combination of how likely a harmful event is and how bad the impact would be.

A simple way to prioritise is to ask, for each important asset: what could go wrong, how likely is it, how bad would it be, and what would reduce it?

Treating risk

There are four basic responses:

1. Reduce it with controls, such as enabling MFA.
2. Avoid it by not doing the risky thing, such as not storing card numbers at all.
3. Transfer it, for example through insurance or a specialist provider.
4. Accept it consciously when the cost of reducing it is higher than the risk.

Doing nothing without deciding is not acceptance; it is just ignored risk.

Types of controls

• Preventive: stop something happening, such as MFA or a firewall.
• Detective: notice when it happens, such as alerts on suspicious logins.
• Corrective: recover afterwards, such as restoring from backup.

Good security combines all three, because no preventive control is perfect.

Defence in depth

Layer controls so that one failure does not lead to disaster. If a phishing email gets through the filter, training helps the person spot it. If they click anyway, MFA stops the stolen password from working. If that fails, monitoring spots the unusual login. Each layer buys time and chances.