Lesson 1 of 5

The CIA Triad

The CIA Triad — Confidentiality, Integrity, and Availability — is the foundational model that defines the three core objectives of every information security program. You will learn what each principle means in practice, how real-world attacks violate one or more of them, and how security controls are designed to protect each property. Every security decision you make as a professional will ultimately trace back to these three principles.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

This is asking you to build a clear mental model of the concept — not just memorize a definition, but genuinely understand what it means, why it exists, and how it connects to everything else you are learning. When you can explain "the CIA Triad and explain each component" in your own words to someone who has never heard of it, you have truly learned it.

Why this matters

This objective builds a foundational skill that every security professional uses regularly. Mastering it gives you the vocabulary, mental models, and practical ability to tackle more advanced topics with confidence — and to communicate clearly with both technical and non-technical colleagues.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Apply this skill in a real lab environment, explain it clearly to a colleague or client, and use it as a building block for the more advanced techniques that come later in this course.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

The CIA Triad · Objective 1 of 4

VIDEO

Loading video…

Analyze a data breach

Research the 2017 Equifax breach using publicly available post-mortems — the FTC report and the Congressional testimony are both free online and provide authoritative technical detail. Identify the root cause (an unpatched Apache Struts vulnerability, CVE-2017-5638), the detection failure (the breach went undetected for 78 days), and the impact (147 million records exposed including SSNs, birth dates, and credit card numbers). Map each failure to a CIA triad violation: the confidentiality of 147 million records was compromised, and the integrity of the credit reporting system was undermined. Use this case as a template for analyzing any breach — root cause, detection gap, and CIA impact are the three questions to answer first.

Analyze a ransomware attack

Research the 2021 Colonial Pipeline ransomware attack, which caused fuel shortages across the US East Coast after the company shut down operations as a precaution. The attackers (DarkSide) gained access through a compromised VPN account that lacked multi-factor authentication — a single point of failure that cost the company $4.4 million in ransom and an estimated $100 million in recovery costs. This attack primarily violated availability (the pipeline was offline for six days) but also confidentiality (DarkSide exfiltrated data before encrypting it, a technique called double extortion). Note that Colonial paid the ransom but the FBI later recovered $2.3 million of it by seizing the attacker's cryptocurrency wallet — an important lesson about the limits of paying ransoms.

Design controls for each component

For each breach you analyzed, design a set of preventive, detective, and corrective controls that would have reduced the impact. For Equifax: preventive controls include a vulnerability management program with SLA-enforced patching (the Struts patch was available two months before the breach), detective controls include network segmentation and anomaly detection to catch lateral movement, and corrective controls include an incident response plan with defined escalation paths. Map each control to the NIST Cybersecurity Framework function it supports (Identify, Protect, Detect, Respond, Recover) — this mapping demonstrates that a mature security program requires all five functions, not just preventive technical controls.

Classify security incidents

Using the NIST SP 800-61 incident classification categories, classify each breach you analyzed: unauthorized access, denial of service, malicious code, improper usage, or scans/probes/attempted access. The Equifax breach is unauthorized access (an external attacker exploited a vulnerability to access systems they were not authorized to use). The Colonial Pipeline attack is malicious code (ransomware) combined with unauthorized access (the initial VPN compromise). Practice classifying five additional real-world incidents from the Verizon Data Breach Investigations Report (DBIR), which is free at verizon.com/business/resources/reports/dbir/ and provides hundreds of anonymized real breach cases with classification data.

Back to course Next Lesson