4.1Security Fundamentals (CIA and Risk Management)

When considering information security measures, the baseline to return to first is the CIA triad (confidentiality, integrity, availability). Mapping what a given measure protects onto CIA helps avoid both over-investment and gaps in coverage. The element that is compromised differs by situation even for similar incidents: a leak of a customer list is a confidentiality breach, a defaced website is an integrity breach, and a service outage from a DoS attack is an availability breach. Identifying which element is affected is the starting point for choosing a countermeasure.

4.1.1CIA and complementary properties

• Confidentiality means only authorized parties can access information, protected via access control, encryption, and the principle of least privilege. Integrity means information is accurate and up to date, free of unauthorized tampering or destruction, protected via hash verification, separation of access rights, and preserving change history. Availability means authorized parties can use information/systems whenever needed, protected via redundancy, backups, and load balancing.
• Complementary properties: authenticity assures that a party or object genuinely is what it claims to be (digital signatures, certificates). Accountability means who did what and when can be traced afterward (via logs and audit trails). Non-repudiation preserves evidence so an action cannot later be denied by the person who performed it. Reliability means intended behavior continues to be performed consistently.
• Information assets are what must be protected (customer data, source code, servers, know-how—tangible or intangible). A threat is a potential cause of harm to an asset (human, technical, physical, or environmental). A vulnerability is a weakness a threat can exploit (misconfiguration, unpatched software, inadequate training, etc.). A risk materializes only when a threat meets a vulnerability—this relationship is central.