Basics of Cyber Security: CIA Triad, Risks and a Worked Defence

Terms such as threat, vulnerability, attack, risk and control are often memorised as synonyms. A scenario becomes confusing as soon as it includes a stolen password, an exposed login page and a safeguard together. Cyber security protects systems, networks, applications and information against unauthorised access, harmful change and disruption. Label each incident as asset, threat, vulnerability, attack, risk and control before mapping its CIA failure or calculating how sequential controls reduce account takeover.

Start with the CIA triad, not a list of attacks

The CIA triad describes three security objectives, not products or attack names:

• Confidentiality restricts information to authorised people and processes.

• Integrity preserves correctness and prevents unauthorised change.

• Availability keeps systems and information usable by authorised users when needed.

Consider a college placement portal holding 2,000 student profiles. An outsider reading private contact details causes a confidentiality failure. Changing a student's eligibility status from not eligible to eligible violates integrity. Making the portal unreachable during an application window harms availability.

One incident can affect several objectives. Ransomware may make records unavailable through encryption, alter or destroy data so its integrity is uncertain, and copy data before encryption so confidentiality is also lost. Avoid a one-attack-to-one-letter rule. Ask what happened to the information or service.

Separate asset, threat, vulnerability, exploit, risk and control

Keep the nouns attached to one chain. The asset is the 2,000 student profiles and placement records. The threat source is an attacker holding leaked credentials, while the threat event is an attempted account takeover. Password reuse plus no second factor is the vulnerability. Automated credential stuffing is the exploit method. Unauthorised viewing or alteration of records is the risk, and rate limiting, multi-factor authentication, monitoring and account recovery are controls.

The grammar matters. An attacker is not a vulnerability, a reused password is not a threat actor, and MFA is not the risk. Risk arises when a threat can exploit a vulnerability and harm an asset.

Recognise common attack paths and choose a matching control

Start by identifying the attack path, then choose a control that addresses it.

Detection is cross-cutting, so logs and alerts catch suspicious behaviour that prevention missed. Every control also has a boundary. Encryption in transit does not repair a compromised endpoint, a firewall does not stop every application-level attack, and MFA lowers credential risk without making an account impossible to compromise. Choose a control by knowing what it blocks and what it leaves open. The network-communication row is easier to reason about when you know how traffic moves between layers, and the Computer Networks learn module builds that picture layer by layer.

For the cryptographic mechanisms behind confidentiality and integrity, Cyber and Info Security in Computer Networks works RSA, Diffie-Hellman, signatures, certificates and firewall rules. Cyber Threats and Attacks Explained separates passive from active behaviour, malware families and a DDoS capacity model. Credential stuffing is an identity attack, so its defensive path instead follows password checking, rate and device rules, and MFA.

Worked example: calculate a layered credential-stuffing defence

Suppose an attacker sends 10,000 automated login attempts in one hour. Assume exactly 2% use a correct reused username-password pair. These illustrative rates are inputs to the calculation, not measurements or performance guarantees.

First calculate the attempts that pass the password check:

10,000 x 0.02 = 200

Without another control, there are 200 authenticated malicious attempts. The defensive funnel starts from 200, not all 10,000, because it tracks correct-password attempts that could otherwise authenticate.

Rate limiting and device-risk rules stop 75% of those 200 attempts:

200 x 0.75 = 150 stopped

200 - 150 = 50 remaining

MFA blocks 96% of the remaining 50:

50 x 0.96 = 48 blocked

50 - 48 = 2 expected successful takeovers

The same sequential calculation can be written in one line:

10,000 x 0.02 x 0.25 x 0.04 = 2

The model therefore falls from 200 possible takeovers after the password check to 2 after both layers. Its reduction is:

(200 - 2) / 200 x 100 = 99%

That is a 99% reduction under these assumptions, not a claim that the system is "99% secure". The two surviving takeovers show why alerting, session revocation and account recovery still matter.

This model treats the filters as sequential and gives each a fixed rate. Real attackers adapt, controls can overlap, and actual block rates must come from the organisation's own logs. The arithmetic demonstrates defence in depth. It does not certify a real system.

Build security as prevent, detect, respond and recover

Prevention alone is incomplete. In the portal scenario, preventive controls include MFA, rate limiting, patching, secure configuration and least privilege. Detective controls include failed-login logs, alerts for unusual devices or locations, and monitoring for unexpected record changes.

If an incident occurs, response means containing it, revoking active sessions, resetting affected credentials, preserving relevant logs and checking what the account accessed or changed. Recovery means restoring trustworthy data where necessary, validating service operation and learning which control or procedure must change.

A tested backup supports recovery and availability after data loss or ransomware. It cannot undo a confidentiality breach if an attacker has already copied the records. One control may also serve several functions, so prevent, detect, respond and recover are reasoning aids, not rigid boxes.

Cyber security basics that exams and interviews often distort

Keep these six distinctions clear:

• Authentication checks identity. Authorisation decides permitted actions.

• Encryption is reversible with a key. Cryptographic hashing is designed as a one-way transformation.

• Encoding changes representation. It does not provide secrecy.

• A threat is not the same as a vulnerability.

• Availability means timely authorised access, not merely a powered-on server.

• Residual risk remains after controls are applied.

On the portal, a password plus OTP authenticates a student. Only placement staff may edit eligibility, an authorisation rule. A salted hash verifies passwords without storing originals; TLS protects data in transit. Neither secures the whole portal.

Defence in depth means independent layers, so one failure does not immediately expose the asset. More controls are not automatically better if badly configured, unmonitored or unsafe for authorised users.

How exams turn the basics into scenario questions

Scenario questions ask you to classify a CIA failure, distinguish threats, vulnerabilities and controls, match an attack to a safeguard, separate authentication from authorisation, or calculate attempts surviving sequential controls. Placement rounds test the same distinctions, alongside the other subjects in the CS Fundamentals for Placements line-up. Label each part of the situation instead of reciting a catalogue.

A stem may describe the labels through events and consequences rather than naming them directly. Underline the asset, actor, weakness, action, impact and safeguard in the stem. This turns the scenario into a one-line answer: identify what happened, which security property or control it concerns, and, when controls act sequentially, how many attempts remain.

Try four quick checks:

• Leaked student phone numbers affect confidentiality.

• An unauthorised eligibility edit affects integrity.

• A login flood that prevents authorised access attacks availability.

• If a filter stops 80% of 1,000 suspicious requests, 1,000 x (1 - 0.80) = 200 remain.

Use the same reading method each time. Mark the labels, connect the action to its impact, then state the classification or calculation directly.

Short version and the next study step

CIA tells you what must be protected. The asset is what has value. A threat exploits a vulnerability. The resulting possibility of harm is risk. Controls prevent, detect, respond to or help recover from incidents.

Next, reproduce 10,000 -> 200 -> 50 -> 2 from memory. Explain what the password check removed, what rate limiting plus device risk removed, and what MFA removed. Then explain why the endpoint is a 99% reduction under this model, not proof of perfect security. For a broader structured CS route, continue with ZERO TO HERO.