Educatifu
Open menu

What security actually protects

Before any tool or attack, security is about three goals — confidentiality, integrity, availability — and a habit of thinking like an attacker.

FoundationsCyber Security~11 min

Before this lesson

  • No background needed — this is the starting point

"Cyber security" conjures hoodies and green terminals, but underneath the drama it is a disciplined engineering field with a clear purpose. Strip away the tools and the jargon and it protects just three things.

The CIA triad

Every security control, from a password to a firewall to encryption, exists to protect one or more of:

  • Confidentiality — only authorised people can read the data. (Your messages stay private.)
  • Integrity — the data has not been altered, secretly or accidentally. (The amount on a bank transfer is exactly what was sent.)
  • Availability — the system is there and working when legitimate users need it. (The site stays up; ransomware doesn't lock you out.)

These pull in different directions — locking something down for confidentiality can hurt availability — so security is always a set of trade-offs, not a checkbox.

Think like an attacker: threat modelling

You cannot defend everything against everyone, so you don't try. Instead you threat model — reason deliberately about risk before choosing defences by asking four questions:

  1. What are we protecting? (The assets — data, money, uptime, reputation.)
  2. Who are we protecting it from? (The adversaries — a bored script kiddie, a competitor, an insider, a nation-state. Their skill and motivation differ enormously.)
  3. How could they attack it? (The attack surface — every input, account, dependency and person is a way in.)
  4. What happens if a defence fails? (The impact — and so how much the defence is worth.)

The output is priorities: spend effort where the likely, damaging threats are, not on exotic ones that won't happen or trivial ones that don't matter.

There is no perfect security

A crucial mindset: absolute security does not exist. Given unlimited time and resources, most things can be broken. The realistic goal is to make an attack cost more — in time, money, skill or risk — than the target is worth to the attacker, and to detect and recover when something does get through. Security is economics and probability as much as technology.

With the why in place, the rest of this track builds the how. It starts with the two cryptographic primitives nearly everything else rests on: hashing (for integrity) and keys (for confidentiality). Hashing is next.

A triangle with Confidentiality at the top, Integrity at the bottom-right and Availability at the bottom-left.
The CIA triad — the three goals every security control serves.

Key takeaways

  • Security protects three things: confidentiality (secrecy), integrity (not tampered), and availability (accessible).
  • Threat modelling asks what you're protecting, from whom, and what happens if it fails — before choosing defences.
  • There is no absolute security; the goal is to make attacks cost more than the target is worth to an attacker.

← All Cyber Security lessons

Bring us the problem, not a perfect specification

Tell us what needs to change, who it affects and any important deadline. We will review the context and reply with useful next questions.

  1. 01Share contextDescribe the workflow, constraint or risk.
  2. 02Clarify togetherWe identify missing facts and useful options.
  3. 03Choose a startAgree a focused assessment or delivery step.
Start a conversation