Lesson 1 of 16 · Level 1: Beginner
What Is Cybersecurity? The CIA Triad Explained
- ⏱ 15 min read
- ❓ 4 review questions
- ✍️ Exercise with solution
- 📥 Downloadable template
In this lesson
- What cybersecurity actually protects: data, devices, accounts and the services people depend on.
- The CIA triad (confidentiality, integrity and availability) and how to apply it to real situations.
- The difference between a threat, a vulnerability and a risk, and why that difference matters.
- How "defense in depth" stacks several simple controls so one failure doesn't become a disaster.
- How to take a first baseline of your own security in about 20 minutes.
Start your personal baseline now: mark each item as Done, Partial, Not yet or N/A, and the sheet calculates your score.
- cybersecurity-checklist.xlsx · Personal Checklist sheet
Cybersecurity is the practice of protecting information, devices, accounts and online services from being stolen, changed or knocked offline. It isn't only firewalls and hackers in hoodies: it's also a receptionist who calls back before changing a bank account number, a backup drive that is unplugged at night, and a laptop that is encrypted so a thief gets hardware but not data. In this lesson you'll learn the single model that almost every security decision is built on, the CIA triad, and you'll practice it with a real-world example from a dental office in Phoenix.
Those numbers only count what people reported, so the real total is higher. The good news hidden in the last figure: if most breaches involve a person making a mistake or being tricked, then habits you can learn in this course prevent a large share of them.
- Know what you protect
- Learn the CIA triad
- Separate threat, vulnerability and risk
- Layer your defenses
- Take your baseline
What cybersecurity protects
Before you can protect anything, you need to know what "anything" is. Security people call these things assets: anything of value that would hurt to lose. For a person or a small business, assets fall into four groups:
- Data: tax returns, patient charts, customer lists, photos, contracts, passwords.
- Devices: laptops, phones, tablets, routers, smart cameras, the office printer.
- Accounts and identities: your email, bank login, cloud storage, social media, the admin account of your website.
- Services: the ability to take payments, schedule appointments, answer email or ship orders.
Notice that email shows up as the most important account for almost everyone. Whoever controls your inbox can reset the password of almost every other account you own. That's why, throughout this course, email is always the first account to lock down.
Cybersecurity also has three ingredients, often called people, process and technology. Technology is the antivirus and the encryption. Process is the rule that says "we always call the vendor back on a known number before changing payment details." People are the ones who follow (or skip) the process. Weakness in any one of them undoes the other two.
The CIA triad: three questions behind every security decision
The CIA triad has nothing to do with the intelligence agency. It's a simple model that describes the three things security tries to preserve. When something goes wrong, at least one of them breaks.
Confidentiality
Only the right people can see the information. A patient's X-rays are visible to the dentist, not to the whole internet.
Typical controls: passwords and MFA, encryption, access permissions, locking screens, shredding paper.Integrity
Information is accurate and hasn't been changed by someone who shouldn't change it. An allergy note says "penicillin" because that's the truth.
Typical controls: edit permissions, change logs, version history, checksums, approval steps for payments.Availability
Information and systems work when people need them. The scheduling system is up at 8 a.m. on Monday.
Typical controls: backups, updates, spare equipment, power protection, a plan to restore service.The triad in a real business: a dental office in Phoenix
Picture Desert Smile Dental, a fictional practice in Phoenix with three dentists and 14 staff members. Here is how each part of the triad can fail, and what each failure costs:
| What happened | Pillar that broke | Consequence | Control that would have helped |
|---|---|---|---|
| An unencrypted laptop with 2,300 patient records is stolen from a car | Confidentiality | A HIPAA breach that requires notifying patients and HHS | Full-disk encryption and a policy against leaving devices in cars |
| A temp worker edits the wrong chart and removes an allergy | Integrity | Risk to a patient's health | Role-based permissions and an audit trail of chart changes |
| Ransomware locks the practice management system for a day | Availability | 42 appointments canceled | Offline backups that are tested, plus timely updates |
| An email "from the supply company" changes its bank account number | Integrity (of payment data) | A payment sent to a criminal | Calling the vendor on a known phone number before any change |
Let's put a price on the availability failure. If the office averages $210 of production per appointment and loses one full day of 42 appointments, the direct loss is:
42 appointments × $210 = $8,820 for one day of downtimeThat's before overtime to reschedule, the IT bill to recover and the patients who don't come back. Three days offline would cost $26,460 in production alone. Numbers like these are how you convince a busy owner that a $150-a-month backup service is cheap.
Health care providers that bill electronically, health plans and clearinghouses are "covered entities" under HIPAA. If unsecured patient information is breached, they must notify affected individuals within 60 days of discovery. Breaches of 500 or more people must also be reported to HHS within 60 days, and the media must be notified when more than 500 residents of a state are affected. Smaller breaches are logged and reported to HHS within 60 days after the end of the calendar year. HIPAA's notification rules apply to unsecured data, which is one more reason to encrypt every laptop. This is educational information, not legal advice.
1. Ransomware encrypts every file on a bakery's point-of-sale computer, so it can't take orders. Which part of the CIA triad is most directly affected?
The bakery can't use its own system: that's an availability failure. Many modern ransomware gangs also steal data before encrypting it, which adds a confidentiality problem, but the immediate pain is that the business stops.
Beyond CIA: three related ideas you'll hear
- Authenticity: you can confirm who sent something. A digitally signed software update proves it really came from the vendor.
- Non-repudiation: someone can't credibly deny an action they took, because there's a reliable record (for example, an e-signature with an audit trail).
- Privacy: closely related to confidentiality, but broader. It covers how personal data is collected, used and shared, even when it's perfectly "secure." You'll study it in lesson 8.
Threat, vulnerability and risk: three words people mix up
These three terms appear in every security framework, exam and job interview. They mean different things:
| Term | Plain-English meaning | Home example | Business example |
|---|---|---|---|
| Threat | Something or someone that could cause harm | A burglar | A criminal group sending fake invoices |
| Vulnerability | A weakness the threat could use | A window that doesn't lock | No rule to verify bank-detail changes |
| Risk | How likely the harm is and how bad it would be | Chance of a break-in × value of what's inside | Chance of a fake-invoice payment × typical invoice size |
A useful shorthand that you'll expand in lesson 10:
Risk = Likelihood × ImpactYou usually can't remove threats (criminals will keep trying), but you can remove vulnerabilities and reduce impact. Fixing the window lock lowers likelihood. Keeping valuables in a safe lowers impact. In cybersecurity, applying an update removes a vulnerability, and a tested backup reduces impact.
2. A small law firm's website runs a plugin with a known security flaw that hasn't been updated in two years. What is the outdated plugin?
The plugin is a weakness: a vulnerability. The threat is whoever might exploit it, and the risk combines how likely that is with how much damage it would cause.
Defense in depth: never rely on one control
No single control is perfect. Antivirus misses new malware, people click links, passwords leak. Defense in depth means stacking several independent layers so an attacker has to beat all of them. If one layer fails, the next one catches the problem or limits the damage.
- Layer 1 · PeopleTraining and verification habitsStaff recognize phishing and verify unusual requests by phone.
- Layer 2 · IdentityStrong, unique passwords plus MFAA stolen password alone isn't enough to get in.
- Layer 3 · DevicesUpdates, encryption and endpoint protectionKnown holes are patched, and a lost laptop reveals nothing.
- Layer 4 · NetworkFirewall, secure Wi-Fi and segmentationEven if one device is infected, it can't easily reach the others.
- Layer 5 · RecoveryOffline, tested backups and an incident planIf everything else fails, you restore instead of paying a ransom.
Desert Smile Dental decided to spend $6,000 in its first year on exactly these layers. This is how the budget was split:
- Backups (30%) $1,800Protects availability: offline and cloud copies, tested every quarter.
- Device encryption and management (25%) $1,500Protects confidentiality if a laptop or tablet is lost.
- MFA and password manager (20%) $1,200Protects every account against stolen passwords.
- Staff training (15%) $900Short monthly sessions on phishing and verification.
- Patch management support (10%) $600An IT provider makes sure updates actually install.
3. A company has excellent antivirus but no backups and no MFA. Which principle is it ignoring?
It depends on a single layer. When that layer misses something (and eventually it will), there's nothing behind it to stop the damage or recover.
Security vs. convenience: finding the balance
Every control adds a little friction. If security is too painful, people work around it: they write passwords on sticky notes or email files to their personal accounts. Good security makes the safe way the easy way. A password manager is more secure and faster than typing passwords. Automatic updates are safer and less work than remembering to update. When you choose controls, ask two questions: does it reduce real risk, and will people actually use it?
Common beginner mistakes
"We're too small to be a target."
Most attacks are automated and opportunistic. Small businesses get hit precisely because they're easier.
Treating security as an IT-only problem.
People and processes matter as much as technology. A phone call to verify a request is a security control.
Buying one expensive tool and calling it done.
Layer several basic controls: MFA, updates, backups, training. They cost little and cover each other's gaps.
Protecting data but forgetting availability.
Ask "how would we keep working if this system disappeared today?" and test the answer.
4. A Phoenix optometry clinic averages $180 per appointment and books 35 appointments a day. If its scheduling system is down for two days, what is the direct production loss?
35 × $180 = $6,300 per day, and two days is $12,600. Putting a dollar figure on downtime helps you decide how much to invest in backups and recovery.
Practice exercise
Classify each incident by the CIA pillar it mainly affects and suggest one control that would have prevented it or reduced the damage:
- A coworker reads the HR folder with everyone's salaries because it's shared with the whole company.
- A storm knocks out power and the office server shuts down hard; nobody can work for a day.
- Someone changes the price of a product on an online store from $49 to $4.90.
- A phone with no screen lock is lost on a bus; it has the work email app open.
- A payroll file is modified so one employee's direct deposit goes to a new account.
- A cloud storage link to customer invoices is set to "anyone with the link."
See solution
- 1. Confidentiality. Restrict the HR folder to HR staff only (least privilege).
- 2. Availability. A battery backup (UPS), cloud or offline backups and a documented recovery plan.
- 3. Integrity. Limit who can edit prices, require MFA on the store admin and review the change log.
- 4. Confidentiality. Require a screen lock and enable remote wipe on every phone with work data.
- 5. Integrity. Require a second person to approve bank-detail changes and confirm with the employee in person or by a known phone number.
- 6. Confidentiality. Share only with specific people, set links to expire and review sharing settings monthly.
Notice that several fixes are processes, not products. That's typical: many of the best controls cost nothing.
Summary
- Cybersecurity protects data, devices, accounts and services, using people, processes and technology together.
- The CIA triad asks three questions: who can see it (confidentiality), is it correct (integrity) and does it work when needed (availability).
- A threat is who or what can hurt you, a vulnerability is the weakness, and risk combines likelihood and impact.
- Defense in depth stacks independent layers so one failure doesn't become a disaster.
- Putting a dollar value on downtime or a breach helps you decide what to protect first.
Next lesson: Common Threats: Malware, Ransomware and More. You'll learn how the most common threats work, how ransomware attacks unfold and which defenses stop them at each stage.
Create your account in 30 seconds, mark your lessons and download your certificate at the end.