Security basics: what we protect and from whom
Before any attack or defence, two questions: what are we protecting, and who from? Walk through a small office network to meet confidentiality, integrity and availability (the CIA triad) and authentication. Then learn the difference between a threat, a vulnerability and a risk, see the three places an attacker can sit, and why defence in depth puts a layer in front of each.
6 quick questions
Pick an answer to see why. Your score saves with your progress.
01Someone floods the file server with so much junk traffic that it stops answering, though no data leaks and nothing changes. Which property is lost?
No data leaked and nothing was changed, but the service does not work when people need it. That is availability.
02A number in the payroll file is changed on its way to your laptop. What lets the laptop notice?
A keyed check value (a MAC, such as HMAC) only matches if nothing changed. A plain checksum is not enough: an attacker can recompute it after changing the data.
03The file server accepts your password, but stops you deleting the payroll file because your account is not allowed to. Which step stopped you?
Authentication already succeeded: the server knows who you are. Authorisation then decides what that account may do, and deleting payroll is not on the list.
04The office router runs old software with a published bug. In security terms, that bug is a…
A vulnerability is a weakness. The threat is whoever might use it; the risk is how likely that is, times how bad the harm would be.
05Which attacker can read your unencrypted traffic?
Every packet passes through an on-path attacker, so anything not encrypted can be read or changed. A distant internet attacker never sees your traffic go by.
06What does defence in depth mean?
Firewall, Wi-Fi security, encryption, strong logins and updates each stop different attacks. An attacker has to beat all of them, not just one.
Glossary
- Confidentiality
- Only the people who should read the data can read it. Usually kept with encryption.
- Integrity
- Data is not changed without anyone noticing. Usually kept with keyed check values (MACs) or signatures.
- Availability
- The service works when it is needed: not crashed, switched off or flooded.
- Authentication
- Proving who you are (a password, a security key, a certificate). Authorisation then decides what you may do.
- Threat
- Someone or something that could cause harm, such as a criminal or a power cut.
- Vulnerability
- A weakness a threat could use, such as unpatched software or a weak password.
- Risk
- How likely the harm is, combined with how bad it would be.
- Defence in depth
- Several independent layers of protection, so one failure is not the end.
Notes and sources
- The office LAN uses the private range 192.168.1.0/24 (RFC 1918); 203.0.113.10 and 198.51.100.66 are RFC 5737 documentation addresses, and the MAC addresses come from the RFC 7042 documentation block (00:00:5e:00:53:xx).
- The definitions of confidentiality, integrity and availability follow FIPS 199 (from US law, 44 U.S.C. §3552; §3542 in FIPS 199 itself). Authentication is not part of the triad; it is the gate that lets the system enforce all three.
- Risk = likelihood × impact is the simple qualitative form; NIST SP 800-30 Rev. 1 describes risk as a combination of the likelihood of a threat event and its adverse impact.
- On-path and off-path attackers come from the Internet threat model in RFC 3552. An attacker can move between positions: a remote attacker who breaks into one office PC becomes an attacker on the LAN.
- The payroll file and the router's old bug are made-up examples.
- FIPS 199: Standards for Security Categorization (confidentiality, integrity, availability)
- RFC 4949: Internet Security Glossary, Version 2
- NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments
- RFC 3552: Guidelines for Writing RFC Text on Security Considerations (the Internet threat model)
- NIST SP 800-63B: Digital Identity Guidelines, Authentication
Quiz Unlocks after the last step.