Security advice often sounds like a list of unrelated chores: patch this, back up that, train everyone, restrict access. The CIA triad and threat modelling give you a way to decide which chores matter for a particular system.
The CIA triad
Confidentiality means only authorised people can read the data. Encryption, access control and careful sharing support it.
Integrity means the data is accurate, complete and has not been changed without authorisation. Hashes, signatures, audit logs and change control support it.
Availability means the data and services are there when needed. Backups, redundancy, capacity planning and denial-of-service protection support it.
A control can help one and hurt another. Encrypting a backup protects confidentiality; losing the key destroys availability. A public read-only status page improves transparency; if it leaks internal detail, it harms confidentiality.
Risk: likelihood and impact
Risk is the chance of something bad happening multiplied by how bad it would be. A useful working formula is:
risk ≈ likelihood × impact
A stolen laptop with full-disk encryption and a strong login is lower risk than the same laptop with an unlocked session and a password file on the desktop. The threat is similar; the exposure is not.
Organisations usually handle risk in one of four ways:
- Mitigate: add a control that reduces likelihood or impact.
- Transfer: insurance or a contract shifts some financial impact.
- Avoid: stop doing the risky activity.
- Accept: document the decision and move on.
Accepting a risk is legitimate when it is explicit. Pretending a risk does not exist is not.
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.