The CIA Triad, Security Goals & the Modern Threat Landscape

Prerequisites

None. This is the first card in the Cyber Foundations path. A basic ability to read and a curiosity about how digital systems fail is all you need.

Why This Lesson Matters

Every security practitioner — from a first-year SOC analyst to a CISO — organises their thinking around a small set of foundational ideas. The CIA triad is the most important of these. Without it, security conversations become vague lists of technical controls with no unifying principle. With it, any attack, any compliance requirement, any architectural decision, and any incident report can be understood and communicated clearly.

This lesson builds the conceptual scaffold that every other lesson in this programme relies on. You will encounter the CIA triad again in threat modelling, in incident classification, in risk assessment, and in every pentest report you write. It is not academic background — it is operational vocabulary.

1. The CIA Triad

The triad names three security properties that every information system is expected to provide. They are intentionally broad because they need to apply to every system, from a paper filing cabinet to a distributed cloud application.

          Confidentiality
               ▲
              / 
             /   
            /     
           /  CIA  
          /  Triad  
         /___________
    Integrity     Availability

1.1 Confidentiality

Definition: Information is accessible only to those who are authorised to access it.

Confidentiality is violated when an unauthorised party reads, copies, or infers information they should not have. The violation does not require the data to be modified or destroyed — simply reading it is enough.

Real-world examples:

Controls that defend Confidentiality: - Encryption at rest and in transit - Access control (RBAC, ABAC, need-to-know principle) - Data classification and labelling - Data Loss Prevention (DLP) systems - Network segmentation to prevent lateral access - Employee training on handling sensitive data

1.2 Integrity

Definition: Information and systems are accurate, complete, and have not been modified by unauthorised parties.

Integrity has two dimensions: data integrity (the content is correct) and system integrity (the system behaves as designed). Both matter.

Real-world examples:

Controls that defend Integrity: - Cryptographic hashing (SHA-256, SHA-3) — detect any change - Digital signatures — prove authorship and detect modification - Write-once / append-only logging - Code signing for software distribution - Checksums in file transfer protocols - Database transaction logs and rollback capability - Change management processes (change approval before modification)

A note on hashing vs. encryption: Hashing is not encryption. A hash function takes arbitrary input and produces a fixed-length output (digest). It is one-way — you cannot recover the original data from the hash. Its purpose is integrity verification, not confidentiality. If you hash a file before and after transfer and the digests match, you know the file was not modified.

# Generating a SHA-256 hash to verify integrity
sha256sum important_file.tar.gz
# Output: a3f9b2... important_file.tar.gz

# Verify after transfer (hashes must be identical)
sha256sum important_file.tar.gz
# If different → file was modified in transit or at rest

1.3 Availability

Definition: Authorised users can access information and systems when they need them.

Availability is violated when a system is inaccessible, degraded, or unusable, regardless of whether confidentiality or integrity are affected.

Real-world examples:

Controls that defend Availability: - Redundancy and failover (active-passive, active-active clusters) - Backups (3-2-1 rule: 3 copies, 2 media types, 1 offsite) - DDoS mitigation services (CDN, rate limiting, scrubbing) - Capacity planning and auto-scaling - Patch management (unpatched bugs can cause crashes) - Disaster recovery planning and regular testing

2. The Triad in Tension

A critical insight: the three properties often trade off against each other. A security architect's job is not to maximise all three simultaneously — it is to make deliberate trade-offs aligned with the business context.

A hospital illustrates this tension clearly. Medical records must be confidential (HIPAA, PIPEDA). But if a doctor cannot access a patient record during an emergency because access controls are too strict, availability failure can cost a life. The security design must weigh both.

3. Extended Security Properties

Beyond CIA, several additional properties appear in professional frameworks:

Authentication — the claim of identity is verified ("you are who you say you are").

Non-repudiation — a party cannot deny having performed an action. Digital signatures provide this: if you sign a document with your private key, you cannot later claim you did not.

Accountability — actions are traceable to specific entities. Logging and audit trails serve this purpose.

Privacy — a user-facing concern closely related to confidentiality. Privacy considers the individual's right to control their own information, not just whether an organisation protects it.

The ISO/IEC 27001 standard extends CIA to include Authenticity, Reliability, and Non-repudiation as part of its information security properties definition.

4. Threats, Vulnerabilities & Risk

These three terms are frequently confused. They have precise definitions.

4.1 Definitions

4.2 The Risk Equation

Risk = Likelihood × Impact

This is deliberately simple. In practice both factors are estimated, not measured. A 5×5 risk matrix is the most common tool:

    │  1-Negligible │ 2-Minor │ 3-Moderate │ 4-Major │ 5-Critical │
────┼───────────────┼─────────┼────────────┼─────────┼────────────┤
5   │       5       │   10    │     15     │   20    │     25     │ ← Certain
4   │       4       │    8    │     12     │   16    │     20     │ ← Likely
3   │       3       │    6    │      9     │   12    │     15     │ ← Possible
2   │       2       │    4    │      6     │    8    │     10     │ ← Unlikely
1   │       1       │    2    │      3     │    4    │      5     │ ← Rare
    Likelihood ↑ / Impact →

Scores 15–25: Critical — must be treated immediately. Scores 8–12: High — treatment plan required. Scores 4–6: Medium — schedule for remediation. Scores 1–3: Low — accept or monitor.

4.3 Threat Actors & Motivation

Not all threats are equivalent. Understanding who might attack a system and why shapes the appropriate defence.

APT (Advanced Persistent Threat) refers specifically to well-resourced, patient attackers — typically nation-states or their proxies — who enter a network and remain undetected for months while pursuing specific intelligence objectives.

5. The Modern Threat Landscape (2024–2026)

Understanding the current environment grounds all the concepts above.

5.1 Dominant Attack Categories

Ransomware remains the highest-impact threat to most organisations. Modern ransomware operations are Ransomware-as-a-Service (RaaS) businesses with affiliate programmes, help desks, and negotiation teams. The double-extortion model (encrypt AND threaten to publish data) means availability and confidentiality are both attacked simultaneously.

Credential compromise is the most common initial access method. Phishing, credential stuffing against password-reused accounts, and session token theft via infostealers account for the majority of breaches. MFA deployment has been the most effective single control against this category.

Supply chain attacks target the software delivery pipeline — inserting malicious code into libraries, update mechanisms, or managed service providers. The SolarWinds (2020) and XZ Utils (2024) incidents demonstrated how a single compromised upstream component can affect thousands of downstream organisations simultaneously.

Cloud misconfiguration has grown proportionally with cloud adoption. Public S3 buckets, over-permissive IAM roles, Terraform state files exposed in git repositories, and publicly accessible Kubernetes dashboards are consistently among the top findings in cloud security assessments.

5.2 Why Defenders Are at a Structural Disadvantage

Attackers only need to find one exploitable weakness. Defenders must secure every potential entry point — including entry points they do not know exist. This asymmetry is fundamental and explains why:

• Defence-in-depth (multiple overlapping controls) is necessary
• Assume-breach thinking (plan for the attacker already being inside) is standard
• Threat intelligence (knowing what attackers are doing right now) is operationally valuable

6. Common Mistakes & Misconceptions

Mistake 1: "Our data is not valuable — we will not be targeted." Most attacks are not targeted at all. Ransomware groups use automated scanning to find exposed systems. You do not need to be interesting to be a victim; you need to be reachable.

Mistake 2: "We have a firewall, so we are secure." A firewall is one control. It does not prevent phishing, insider threats, web application attacks, or any technique that operates over allowed traffic (HTTPS port 443 is almost universally open).

Mistake 3: "Security is the IT department's problem." Security failures typically originate in business decisions: not patching because it would require downtime, not enabling MFA because employees find it inconvenient, storing data longer than necessary because "it might be useful." Security is a shared organisational responsibility.

Mistake 4: Conflating CIA properties. A ransomware attack is primarily an Availability and Integrity attack. Calling it a confidentiality breach is incorrect unless data was also exfiltrated. Precision matters when writing incident reports and regulatory notifications.

Mistake 5: Treating risk as binary. Risk is never zero. The question is never "are we secure?" — it is "is our residual risk within acceptable tolerance?" Every organisation accepts some level of risk; the professional question is whether that acceptance is conscious and documented.

7. Guided Example — Classify the Incident

Read each scenario and identify: (a) which CIA property/properties are affected, (b) the threat actor category, (c) the likely vulnerability that was exploited.

Scenario A: A healthcare provider discovers that 50,000 patient records were downloaded by an attacker who used stolen employee credentials obtained through a phishing email. The records are now for sale on a dark web forum.

• CIA impact: Confidentiality (records accessed and disclosed without authorisation)
• Threat actor: Cybercriminal (financial motivation — selling data)
• Vulnerability: Credential reuse / no MFA on the employee portal

Scenario B: A manufacturing company discovers that their industrial control system was remotely accessed and a firmware parameter was silently modified. Production quality metrics have been slightly wrong for three weeks.

• CIA impact: Integrity (data and system behaviour modified without authorisation)
• Threat actor: Nation-state APT or sophisticated competitor (sabotage / industrial espionage)
• Vulnerability: Internet-exposed OT system, weak authentication

Scenario C: A SaaS company's login page becomes unreachable for four hours due to a volumetric UDP flood from a botnet.

• CIA impact: Availability (service inaccessible to legitimate users)
• Threat actor: Cybercriminal or hacktivist (extortion or protest)
• Vulnerability: Insufficient DDoS mitigation capacity

8. Practice Exercises

Work through these before moving to the assessment.

1. For each of the following controls, identify which CIA property/properties it primarily defends:
2. Full-disk encryption on laptops
3. RAID-6 storage array
4. Digital signature on software releases
5. Role-based access control
6. Immutable backup vault

7. Web Application Firewall (WAF)

8. A startup is building a payment application. List three assets, three threats, and three vulnerabilities specific to this context. For each (threat, vulnerability) pair, propose one control.

9. You receive a security alert: "Unusual outbound DNS traffic detected from workstation WS-042." Using the vocabulary from this lesson, describe the possible CIA properties at risk and the threat actor categories you should consider.

9. Lab

Assessment mode: quiz

The practical assessment for this card is a scenario-based quiz. You will be presented with 8 incident descriptions and must: - Identify the CIA property/properties affected - Select the appropriate threat actor category - Choose the most relevant control from a provided list

A score of ≥ 80% is required to pass.

No CTF challenge is assigned to this card — the lab is a structured scenario quiz built into the platform.

10. Framework Alignment

11. Further Reading

• NIST SP 800-12 Rev.1 — An Introduction to Information Security (free, ~100 pages, authoritative US federal baseline)
• ENISA Threat Landscape 2024 — Annual report on the European threat landscape; excellent for understanding current attacker TTPs
• Verizon DBIR (Data Breach Investigations Report) — Published annually; statistically grounded analysis of real-world breaches
• Ross Anderson — Security Engineering (3rd ed.) — The most comprehensive textbook on security engineering; Chapter 2 covers psychology and economics of security decisions
• ATT&CK Framework — https://attack.mitre.org — The canonical reference for adversary tactics and techniques

["Define each of the three CIA triad properties and give two concrete examples per property of how it can be violated", "Distinguish threat, vulnerability, exploit, risk, control, and residual risk using precise definitions and apply them to a described scenario", "Classify an incident report by its primary CIA impact and identify the threat actor category most consistent with the observed behaviour", "Apply a 5x5 risk matrix to estimate and prioritise risk for a described asset-threat-vulnerability combination"]

Prerequisites → Why this matters → CIA Triad (Confidentiality / Integrity / Availability with examples and controls) → Extended properties → Threats, Vulnerabilities & Risk (definitions + risk matrix + threat actor taxonomy) → Modern threat landscape → Common mistakes → Guided classification examples → Practice exercises → Quiz assessment → Framework alignment → Further reading