Module 73: Security Introduction
Confidentiality, integrity, availability
🏠The everyday picture
A bank locker must keep others out (confidentiality), keep your things exactly as you left them (integrity), and open when you come to use it (availability). Failing any one of the three is a failure of the locker.
📘What it really is
- Security protects three things, called the CIA triad:
- confidentiality: only the right people can see information (customer details, passwords, business plans);
- integrity: information isn't changed wrongly, whether by an attacker, a bug or an accident (an invoice amount, a user's role);
-
availability: the system and data are there when needed (no outage, no locked-up files).
-
Every security control serves one or more of these:
- access controls and encryption → confidentiality;
- validation, permissions, audit logs, backups with checks → integrity;
-
redundancy, rate limits, backups, monitoring → availability.
-
Two more ideas often added:
- authenticity: knowing who you're dealing with (Module 74);
-
accountability: knowing who did what, through logs (Module 72).
-
Security is a trade-off, not a switch. Perfect security would make the system unusable. You decide how much protection each thing needs from what it's worth and what's at risk (Lesson 5).
🖱️Try it
List ten pieces of data or functions in your CRM (customer records, user passwords, the audit log, the export feature, invoices, and so on). For each, write which of confidentiality, integrity and availability matter most, and what would happen if each failed.
✅Quick check
An attacker changes the amount on an unpaid invoice. Which part of the CIA triad is harmed?
Show the answer
Integrity.
Why can't security simply be "maximum" everywhere?
Show the answer
Every control has a cost in money, time and ease of use, so protection is matched to what's at risk.