What security protects

Security is about keeping three things true of the data and systems you care about. People call them the CIA triad (nothing to do with the agency).

Confidentiality: only the right people can read it. A leaked customer list breaks confidentiality. Integrity: it's correct and hasn't been changed without permission. A bank transfer changed from $100 to $10,000 breaks integrity. Availability: it works when it's needed. A website knocked offline by a flood of traffic, or files locked by ransomware, breaks availability.

Four more words describe any security problem. An asset is anything worth protecting: data, a laptop, a website, a person's account. A threat is something that could harm it: a thief, a criminal gang, a fire, a careless click. A vulnerability is a weakness the threat could use: an old unpatched program, a weak password, an unlocked door. Risk is how likely the harm is and how bad it would be. No vulnerability, or no threat, means little risk.

Attackers vary. Most attacks are by criminals after money, and they're opportunists: they scan the whole internet for any machine with a known hole, or send the same scam email to millions. Fewer are targeted: a group picking one company, sometimes backed by a government. Insiders, people who already have access, can do harm on purpose or by mistake.

Threat modelling means asking four questions before something goes wrong: what are we building or running, what could go wrong, what will we do about it, and did we do a good enough job? It's how you spend effort on the risks that matter instead of everything at once.

Defenders also think about the attack surface: every place someone could try to get in, like open ports, sign-in pages, email inboxes and staff. Turning off what you don't use makes the surface smaller, and a smaller surface is easier to protect.