Cyber Security Introduction and the CIA Triad

Cyber security is the practice of protecting systems, networks, applications and data from digital attacks. Every developer, not just security specialists, needs a working knowledge of it: the code you write today becomes the attack surface someone probes tomorrow. This lesson introduces the core vocabulary of security and the single most important mental model in the field, the CIA Triad.

Why Cyber Security Matters for Developers

Modern applications handle passwords, payment details, health records and private messages. A single vulnerability can leak millions of records, destroy user trust and trigger legal penalties under laws like GDPR. Attackers automate their scanning, so even a small hobby site is probed within hours of going online. Security is therefore not an optional add-on you bolt on before launch; it is a property you design in from the first line of code.

The CIA Triad

The CIA Triad describes the three goals every security control ultimately serves.

Confidentiality

Confidentiality means data is readable only by people and systems that are authorized to read it. Encryption, access control lists, authentication and careful logging practices all protect confidentiality. A breach of confidentiality looks like a leaked database or an employee reading records they have no business seeing.

Integrity

Integrity means data cannot be modified without authorization, and any tampering is detectable. Checksums, digital signatures, database constraints and audit trails protect integrity. If an attacker silently changes an account balance or alters a downloaded installer, integrity has failed even though nothing was stolen.

Availability

Availability means systems are up and usable when legitimate users need them. Redundancy, backups, rate limiting and DDoS mitigation protect availability. A ransomware infection that encrypts your files is primarily an attack on availability.

Every attack you will ever study violates at least one leg of the triad, and every defense strengthens at least one. When evaluating a design decision, ask: what does this do to confidentiality, integrity and availability?

Threats, Vulnerabilities and Risk

Three more terms you will meet constantly:

Threat: anything that can cause harm, such as an attacker, malware, or even an accidental deletion.
Vulnerability: a weakness a threat can exploit, such as an unpatched library or a missing input check.
Risk: the likelihood and impact of a threat exploiting a vulnerability. Security work is really risk management, because no system is perfectly secure.

Defense in Depth

Good systems never rely on a single control. Defense in depth layers protections so that when one fails, others still hold: a firewall in front, authentication at the door, input validation in the code, encryption on the data, and monitoring watching everything. The code below shows the idea applied to a simple API route, where several small checks stack up:

javascript

// Defense in depth on a single endpoint
app.get('/api/profile/:id', requireAuth, (req, res) => {
  // 1. Authorization: users may only read their own profile
  if (req.user.id !== req.params.id) {
    return res.status(403).json({ error: 'Forbidden' });
  }
  // 2. Validation: reject malformed ids early
  if (!/^[a-f0-9]{24}$/.test(req.params.id)) {
    return res.status(400).json({ error: 'Invalid id' });
  }
  // 3. Least privilege: return only needed fields
  const user = db.findUser(req.params.id, { fields: ['name', 'email'] });
  res.json(user);
});

No single line above is dramatic, yet together they block whole classes of attacks.

The Principle of Least Privilege

Give every user, process and API key the minimum access it needs, and nothing more. A reporting service that only reads data should use a read-only database account. If that key leaks, the damage is bounded. Least privilege is the cheapest, most reliable security control you can apply, and you will see it again in almost every later lesson.

Key Takeaways

Cyber security protects the confidentiality, integrity and availability of data, known as the CIA Triad.
Threats exploit vulnerabilities; managing the resulting risk is the real job.
Defense in depth layers multiple imperfect controls into a strong whole.
Least privilege limits the blast radius of any single failure.
Security is a design property, not a final step.

Next lesson: Common Cyber Attacks: Phishing, Malware and Social Engineering, where we look at how attackers actually target people and systems.