Cybersecurity Fundamentals: The CIA Triad, Threats, Risk, and Defense in Depth

Step 1: Learn the CIA triad

Almost every security goal falls under one of three headings. Confidentiality means only authorized people can see information, which encryption and access control protect. Integrity means information is accurate and has not been altered improperly, which hashing, digital signatures, and change controls protect. Availability means systems and data are accessible when needed, which redundancy, backups, and protection against denial of service protect. A single incident can break more than one: ransomware attacks availability and often confidentiality too.

Step 2: Separate threats, vulnerabilities, and risk

A threat is something that could cause harm, such as a criminal group or a careless insider. A vulnerability is a weakness that a threat can exploit, such as unpatched software or a weak password. Risk is the chance that a threat exploits a vulnerability combined with the damage it would cause. Controls reduce risk: preventive controls stop incidents, detective controls notice them, and corrective controls limit the damage and restore normal operations.

Risk = Likelihood x Impact

Example risk register entry
Asset:        Customer database
Threat:       Credential stuffing against the admin login
Vulnerability: No MFA, reused passwords
Likelihood:   High      Impact: High      => Risk: High
Controls:     Enforce MFA (preventive), alert on failed logins (detective),
              tested backups (corrective)

Step 3: Know the common attack types

Phishing and social engineering trick people into giving up access. Malware, including ransomware, runs hostile code on a device. Credential attacks include credential stuffing, which reuses passwords leaked elsewhere, and password spraying, which tries a few common passwords against many accounts. Injection and other web application attacks abuse flaws in how apps handle input. Denial-of-service attacks overwhelm a service. Man-in-the-middle attacks intercept traffic. Insider threats come from people with legitimate access, and supply chain attacks compromise the software and services you depend on.

Step 4: Apply defense in depth, least privilege, and zero trust

Defense in depth means layering controls so that no single failure causes a breach: for example, a patched system behind a firewall, with MFA, monitoring, and backups. Least privilege gives every person and program only the access they need. Zero trust is a model that does not trust a user or device just because it is inside the network; every request is verified, using identity, device health, and context.

Step 5: Meet the frameworks professionals use

The NIST Cybersecurity Framework 2.0, published in February 2024, organizes security into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Govern was added in version 2.0 to cover setting risk tolerance, roles and responsibilities, and policy. The CIS Critical Security Controls, currently version 8.1, list 18 prioritized controls with 153 safeguards, grouped into Implementation Groups: IG1 is essential cyber hygiene that every organization should start with, IG2 builds on it, and IG3 includes everything. Use a framework as a checklist and a common language, not as a guarantee of safety.