1 Foundations of Information Security

Purpose and security goals

Information security protects valuable information and the systems that store, process, and transmit it from unauthorized access, disclosure, modification, disruption, or destruction. Its central goals are confidentiality, integrity, and availability, together known as the CIA triad. These goals help identify what needs protection and how a security incident could cause harm.

Assets, threats, vulnerabilities, and risk

Assets are things of value that a person or organization owns, uses, or depends on. They can be tangible, such as computers and network equipment, or intangible, such as data, software, services, intellectual property, and reputation.

A threat is a circumstance or event with the potential to cause harm to an asset, system, or organization. A threat may involve a deliberate action, such as an attacker attempting to steal data, or an event such as a fire or power failure.

A vulnerability is a weakness in a system, its design, procedures, or controls that a threat could exploit or trigger. Examples include unpatched software, weak passwords, and inadequate backups.

Risk concerns the possibility of harm in terms of both its potential impact and its likelihood. In information security, it often concerns the effects of losing confidentiality, integrity, or availability. Risk is assessed in context and is not always calculated with one universal formula.

How security risks arise

These concepts connect: a threat may exploit a vulnerability and cause harm to an asset. The resulting risk depends on how likely that event is and how serious its consequences would be.

For example, in an online service that stores customer records, the records and service are assets, a criminal trying to steal records is a threat, and an unpatched server could be a vulnerability. If the criminal exploits that weakness, the likelihood and consequences of exposing customer information inform the organization’s risk.

The three goals in practice

Confidentiality means preserving authorized restrictions on access to and disclosure of information. For example, a school can limit access to student records so an unauthorized person cannot view them.

Integrity means guarding against improper modification or destruction and protecting the accuracy and completeness of information. A payroll system, for example, should prevent unauthorized changes to an employee’s salary and preserve accurate payment records.

Availability means ensuring that authorized users can access and use information and systems when needed. Hospital staff, for example, need reliable access to patient records during care.

Recognizing which goal is affected

The goals are related but distinct, and a security incident can affect one, two, or all three. Ransomware, for example, may make files unavailable and may also threaten confidentiality if attackers have copied them.

In the online-service example, exposing customer information primarily harms confidentiality. If records are also altered, integrity is affected; if the service is knocked offline, availability is affected. An outage can harm availability even when information is neither disclosed nor altered.