The Security Mindset
The CIA Triad, key security concepts, and how attackers think.
Learning Objectives
- → Explain the CIA Triad with real-world examples
- → Define asset, threat, vulnerability, risk, and exploit
- → Describe the Cyber Kill Chain phases
- → Think like an attacker using threat modelling
The CIA Triad
Every security decision should be measured against three goals:
| Pillar | Definition | Example attack |
|---|---|---|
| Confidentiality | Data accessible only to authorised parties | Data breach, eavesdropping |
| Integrity | Data is accurate and unmodified | SQL injection altering records |
| Availability | Systems are accessible when needed | DDoS attack |
Some models add Non-Repudiation (you can't deny an action you took) and Authentication.
Threat Actors
| Actor | Motivation | Sophistication |
|---|---|---|
| Script kiddie | Fun, curiosity | Low |
| Hacktivist | Ideology, politics | Medium |
| Cybercriminal | Financial gain | Medium-High |
| Insider threat | Grievance, money | Varies |
| Nation-state (APT) | Espionage, sabotage | Very High |
Attack Surface
The attack surface is everything that can be attacked: open ports, web applications, employee email addresses, physical access points, third-party software.
Reduce it by:
- Disable unused services and ports
- Remove unused software (fewer dependencies)
- Apply least privilege
- Segment the network
Defence in Depth
No single control is perfect. Layer multiple defences so that if one fails, others still protect:
Perimeter (firewall) → Network (IDS/IPS) → Host (antivirus, EDR)
→ Application (WAF, secure coding) → Data (encryption, DLP)
→ People (security awareness training)
Risk = Likelihood × Impact
A vulnerability with high likelihood of exploitation and high impact = critical risk. Patch it immediately.
Low likelihood + low impact = accept the risk or mitigate later.
Every security decision revolves around three pillars. The CIA Triad is the foundation of information security — memorise it, internalise it, apply it to every problem.
| Pillar | Goal | Attack that breaks it | Defence |
|---|---|---|---|
| Confidentiality | Only authorised users see data | Data breach, sniffing | Encryption, ACLs, MFA |
| Integrity | Data is accurate and unmodified | SQL injection, MITM tampering | Hashing, digital signatures |
| Availability | Systems reachable when needed | DoS/DDoS, ransomware | Redundancy, backups, CDN |
Which CIA pillar is violated in a ransomware attack that encrypts your files?
Hashing a file to verify it hasn't changed protects which pillar?
Security professionals share a precise vocabulary. These six terms appear in every risk assessment, pentest report, and CVE description.
| Term | Definition | Example |
|---|---|---|
| Asset | What you're protecting | Customer database, source code, reputation |
| Threat | A potential harmful event | Hacker exploiting a web app, insider theft |
| Vulnerability | A weakness that can be exploited | Unpatched Log4j, default password |
| Risk | Likelihood × Impact of a threat | High-likelihood + high-impact = critical risk |
| Exploit | Code or technique that triggers a vuln | Metasploit module, proof-of-concept script |
| Control | A safeguard that reduces risk | WAF, firewall rule, security training |
An unpatched Apache server running outdated software is a:
Which term describes the overall chance and impact of a harmful event?
The Cyber Kill Chain (Lockheed Martin, 2011) describes the 7 stages of a cyberattack. Defenders use it to identify where to interrupt an attacker's progress.
| Phase | What attacker does | Defender action |
|---|---|---|
| 1. Reconnaissance | Scan ports, OSINT on LinkedIn | Monitor for port scans, restrict public info |
| 2. Weaponisation | Build exploit + payload | Threat intel feeds, sandbox detection |
| 3. Delivery | Phishing email, malicious USB | Email gateway, user awareness training |
| 4. Exploitation | Trigger vulnerability | Patch management, WAF, EDR |
| 5. Installation | Drop malware/backdoor | AV/EDR, application allowlisting |
| 6. C2 | Phone home to attacker server | Block suspicious outbound, DNS filtering |
| 7. Actions | Exfiltrate data, ransom, destroy | DLP, SIEM alerts, incident response |
In the Kill Chain, which phase involves sending a phishing email?
An attacker's malware connecting back to their server is which Kill Chain phase?
Threat modelling is a structured process for identifying what can go wrong in a system. STRIDE is the most widely used framework, developed at Microsoft.
| Letter | Threat | CIA Pillar violated | Example |
|---|---|---|---|
| S — Spoofing | Pretending to be someone else | Confidentiality | Forged JWT token |
| T — Tampering | Modifying data without permission | Integrity | SQL injection altering records |
| R — Repudiation | Denying an action occurred | Integrity | No audit logs = can't prove who did what |
| I — Information Disclosure | Exposing data to unauthorised users | Confidentiality | Verbose error messages |
| D — Denial of Service | Making a service unavailable | Availability | DDoS flood |
| E — Elevation of Privilege | Gaining higher permissions | All three | Local privesc to root/SYSTEM |
In STRIDE, an attacker performing a DDoS attack represents which threat?
A user forging another user's authentication token is an example of:
💪 Exercises & Challenges
CIA Triad Quiz
Test your understanding of the CIA Triad and core security concepts.
Classify the Security Incident
Identify which CIA pillar is violated in a real-world scenario.
System Hardware Inventory
## Explore Your System Hardware ```bash # CPU info lscpu cat /proc/cpuinfo | grep "model name" | head -1 # RAM free -h cat /proc/meminfo | head -10 # Storage lsblk df -h # All hardware summary sud
Hex to Decimal
Convert hex value `0xC0` to decimal. Submit as `FLAG{decimal_value}`.