1.1The CIA triad and defense-in-depth

A SOC (security operations center) analyst who cannot articulate "what is this failing to protect?" the moment an alert appears cannot triage it. That shared language is the CIA triad. Which of confidentiality, integrity, or availability is threatened changes both the urgency and the next move. And containing damage even after one control is breached is the essence of defense-in-depth. This section builds the ability to decompose an incident by CIA and judge where an added layer would have broken the chain.

1.1.1The three CIA properties

• Confidentiality is the property that only authorized parties can see data; a breach is a data leak. It is protected by encryption, access control, least privilege, and so on. In the SOC you ask "who accessed data they should not see?"
• Integrity is the property that data stays accurate, free of tampering or destruction; a breach is alteration or unauthorized modification. It is protected by hashes, digital signatures, and change control. In the SOC you ask "was this config/file/transaction altered without authorization?"
• Availability is the property that authorized parties can use data/services when needed; a breach is an outage. It is protected by redundancy, backups, and DDoS mitigation. In the SOC you ask "is legitimate users being unable to access caused by an attack?"

1.1.2The defense-in-depth mindset

• Defense-in-depth layers independent controls across the boundary, network, host, application, and data so that if one is bypassed, the next stops the attack. It avoids single-control dependence like "we have a boundary firewall, so host patching can wait."
• Layers also stack along the timeline of prevention, detection, and response: block at the entrance (prevention), notice what slips through (detection = IDS/SIEM), and contain it once noticed (response). SOC monitoring mainly staffs the detection and response layers, serving as the last line of defense for threats that slip past prevention.

You are the on-duty SOC analyst, and at midnight an e-commerce site fires three events in quick succession: (1) a suspected customer-DB dump exfiltrating many records, (2) the product-price table overwritten by an unauthorized UPDATE, dropping some items to 1 yen, and (3) the payment API not responding so orders fail. Rather than lumping them as "all incidents," first decompose each by CIA. Event (1) is unauthorized parties viewing and exfiltrating data—a confidentiality breach; (2) is data that should be correct being altered—an integrity breach; (3) is legitimate users unable to use the service—an availability breach. This decomposition matters because it changes both priority and remedy. For the integrity breach (2), you pin down the diff against pre-tamper hashes or audit logs, restore from a clean backup, and close the tamper path (e.g., SQLi). For the availability breach (3), you use traffic to distinguish a DDoS from mere high load and fail over to redundant capacity. The confidentiality breach (1) drives scoping the leak and considering legal notification. Reviewing through defense-in-depth, the SQLi behind (2) shows that a layer at any of "app WAF (prevention) -> DB least privilege (access) -> tamper detection (detection)" could have broken the chain. CIA tells you "what broke," defense-in-depth tells you "where it could have been stopped"—only by combining the two can you turn a flood of alerts into structured judgment.

1.1.3Section summary

• The CIA triad: confidentiality = leak, integrity = tampering, availability = outage; map the symptom to the harmed property instantly
• Protect integrity with hashes/signatures and availability with redundancy/DDoS mitigation; a confidentiality breach drives leak scoping and notification
• Defense-in-depth layers independent controls to avoid single-control dependence; SOC monitoring mainly staffs the detection and response layers