Security Fundamentals · Lesson 1 of 6
What Is Cybersecurity? The CIA Triad, Threats, Vulnerabilities and Risk
Cybersecurity is protecting systems and data from people and accidents that would misuse, change or destroy them. Learn the CIA triad, the difference between a threat, a vulnerability and a risk, defence in depth, and the main areas of the field.
A hospital's systems are locked by ransomware and surgeries are postponed. A food-delivery app leaks millions of phone numbers. A college student loses ₹40,000 after sharing an OTP with a "bank officer". Three very different events — and all three are cybersecurity failures. The field is about preventing them, detecting them quickly and recovering when they happen anyway.
The CIA triad: what we are protecting
Every security decision protects one or more of three properties:
| Property | Meaning | Broken when… | Typical controls |
|---|---|---|---|
| Confidentiality | Only authorised people can see the data | Exam papers leak; customer data is stolen | Access control, encryption, MFA |
| Integrity | Data is accurate and not changed without permission | Someone edits marks in the results database | Permissions, hashing, digital signatures, audit logs |
| Availability | Systems work when people need them | The results website crashes; ransomware locks files | Backups, redundancy, DDoS protection |
Two more ideas often added: authentication (proving who you are) and non-repudiation (being unable to deny an action you took, through logs and signatures).
Threat, vulnerability, risk — not the same thing
- Vulnerability — a weakness. A server running outdated software; an employee who reuses passwords.
- Threat — something that could exploit it. A criminal group, an automated bot, a disgruntled insider, even a flood.
- Risk — the chance a threat exploits a vulnerability, multiplied by the damage it would cause.
A house analogy: an unlocked back door is a vulnerability; a burglar in the area is a threat; the risk depends on how likely a break-in is and what valuables are inside. Security teams cannot fix everything, so they rank risks and fix the biggest first.
Interview line: "A vulnerability is a weakness, a threat is what could exploit it, and risk is the likelihood and impact of that happening. We reduce risk by removing vulnerabilities, reducing exposure to threats, or limiting impact."
Who are the attackers?
- Cybercriminals — after money: ransomware, fraud, stolen data to sell. By far the most common.
- Hacktivists — make a political or social point, often by defacing sites or leaking data.
- Insiders — employees or contractors, malicious or simply careless.
- State-sponsored groups — espionage and disruption, targeting governments and critical infrastructure.
- Opportunists and bots — automated scanning of the whole internet for known weaknesses, minutes after they are published.
Defence in depth
No single control is perfect, so security uses layers — like a fort with a moat, walls, guards and a locked treasury. If one layer fails, the next one still stands.
- People — training to recognise phishing, clear reporting process.
- Identity — strong authentication, MFA, least privilege.
- Devices — updates, endpoint protection, disk encryption.
- Network — firewalls, segmentation, encrypted connections.
- Application — secure code, input validation, security testing.
- Data — encryption, backups, access logging.
- Monitoring and response — detect, contain and recover.
Main areas of the field
- Security operations (SOC) — monitoring alerts and responding to incidents. The most common entry-level path.
- Application security — finding and fixing flaws in software.
- Penetration testing / red team — authorised simulated attacks to find weaknesses first.
- Cloud security — securing configurations and identities in AWS, Azure, Google Cloud.
- GRC (Governance, Risk, Compliance) — policies, audits and laws like India's DPDP Act and ISO 27001.
- Digital forensics — investigating what happened after an incident.
Try it yourself: Pick one app you use daily (your bank app, college portal or a social media app). For each letter of CIA, write one thing that could go wrong and one control that protects against it. You have just done a mini threat model.
Common interview questions
Try answering each one aloud before you open it.
1What is the CIA triad?
Confidentiality (only authorised access to information), Integrity (information is accurate and not altered without authorisation) and Availability (systems and data are accessible when needed). It is the core model for security goals.
2What is the difference between a threat, a vulnerability and a risk?
A vulnerability is a weakness; a threat is an actor or event that could exploit it; risk is the likelihood of the threat exploiting the vulnerability combined with the impact if it does.
3What is defence in depth?
Using multiple layers of security controls — people, identity, devices, network, application, data and monitoring — so that if one layer fails, others still protect the system.
Practise this
Build something with it
FAQs
Is cybersecurity only for computer science students?
No. Roles in GRC, awareness, audit and SOC welcome people from many backgrounds. Technical depth helps you grow, and you can build it step by step.
What should I learn first?
Networking basics, Linux command line, how the web works and the fundamentals in this track. Then pick a direction — SOC, application security or cloud security — and practise in legal labs.
References & further reading
Finished this lesson?
Mark it complete. Create a free account to save it on every device.