Welcome to post one of my new series, Cybersecurity from Zero to Hero. I am learning security from absolute scratch and writing about it as I go, so you get the explanations while the confusion is still fresh in my head. The plan is simple: concepts first, then networking, then Linux and web security, then real tools and practice platforms. No prior knowledge needed. If you are experienced, stick around anyway, because the comment sections are where you get to correct me and teach everyone else.
One rule before we start, and it applies to this entire series. Every hands on exercise happens only on systems I own or on platforms built for legal practice like TryHackMe and OWASP Juice Shop. Learning security responsibly is part of learning security.
Today we lay the foundation stone of all security thinking.
The one framework everything else builds on
Ask any security professional where to start and you will hear three letters: CIA. Not the agency. It stands for Confidentiality, Integrity and Availability, and it is the lens through which every security decision is made. Firewalls, passwords, backups, encryption, every tool you will ever meet in this field exists to protect one or more of these three properties.
Here is what surprised me on day one of studying this. Security is not about stopping hackers. It is about protecting these three promises, and hackers are only one of many things that threaten them. A flood in a data center is a security event. So is an intern deleting the wrong folder.
🔒 Confidentiality: only the right people can see it
Confidentiality means information is visible only to those authorized to see it. Your medical records, your salary, your private messages.
Real world example. When your banking app logs you out after five minutes of inactivity, that is confidentiality at work. The bank assumes you might have walked away from your phone in a coffee shop. The aggressive timeout is not bad design. It is a deliberate tradeoff that sacrifices your convenience to protect your account from the stranger at the next table.
Tools that protect it: encryption, passwords, multi factor authentication, access controls, and even the privacy screen on a laptop.
The classic violation: a data breach where customer records leak to the public.
✅ Integrity: the data has not been tampered with
Integrity means information stays accurate and unaltered except by authorized changes. It is the promise that what you read is what was written.
Real world example. When you transfer 100 dollars, integrity is the guarantee that it does not become 1000 dollars in transit, and that the recipient account number is not silently swapped. Banks obsess over this. An attacker who can change data is often more dangerous than one who can only read it.
I also ran my first integrity check today, and you can too. When you download software, sites often publish a checksum next to the file. On Mac or Linux:
bash
shasum -a 256 downloaded_file.zip
On Windows PowerShell:
powershell
Get-FileHash downloaded_file.zip
Compare the output to the published value. If even one character differs, the file was corrupted or tampered with somewhere between their server and your machine. That comparison is integrity verification in its purest form, and later in this series we will build our own hashing tool in Python.
Tools that protect it: hashing, checksums, digital signatures, version control, audit logs.
The classic violation: an attacker altering a student database to change grades.
⚡ Availability: the system works when you need it
Availability means authorized users can access the data and systems when they need them. Security that makes a system unusable has failed at its job.
Real world example. When a Distributed Denial of Service attack floods a website with junk traffic until it collapses, nothing was stolen and nothing was altered. Confidentiality and integrity are intact. But the service is down, so it is absolutely a security incident. Backups, failover systems and disaster recovery plans all exist to protect this leg of the triangle.
Tools that protect it: redundancy, backups, load balancing, DDoS protection, disaster recovery plans.
The classic violation: ransomware locking a hospital out of its own patient records.
🔺 The part that made it click for me: the triangle is a tension
Here is the insight most beginner summaries skip. The three properties pull against each other, and real security work is about balancing them, not maximizing all three.
Make a system maximally confidential with twelve authentication steps and you have destroyed availability. Nobody can get in, including the people who should. Make it maximally available with no logins at all and you have destroyed confidentiality. That annoying bank timeout is not a bug or lazy engineering. It is a chosen point on the triangle. Once I saw it this way, a dozen daily annoyances suddenly made sense as deliberate design decisions.
A question for the experienced folks. When you review a system, do you consciously walk the triad, or has it become instinct? And what is your favorite example of a control that helps one leg while hurting another? Drop it in the comments and I will feature the best answers in a future post.
🤔 What confused me today
Where does authenticity fit? Some sources add authenticity and non repudiation as extra properties, and some textbooks talk about a hexad instead of a triad. For now I am parking that question. The triad is the standard mental model and the extensions can wait until the fundamentals are solid.
Is a power outage really a security issue? My instinct said no, that is an IT problem. But under the triad, anything that threatens availability is in scope for security. The field is wider than the hacker movies suggest.
⏭️ Next in this series
Post 2 covers threats, vulnerabilities and risk, three words people use interchangeably that mean very different things. Once you can tell them apart, every security article you read becomes twice as clear. Follow the series so you do not miss it.
