The CIA triad and the tester's mindset

The three goals of security

Nearly every security idea maps to three goals, called the CIA triad. They are not about the spy agency; CIA here stands for Confidentiality, Integrity and Availability.

Confidentiality means only the people who should see data can see it. A leaked password file breaks confidentiality. Integrity means data is correct and has not been changed without permission. If an attacker changes a bank balance, that breaks integrity. Availability means the service is there when people need it. If a site is knocked offline, that breaks availability.

How an attacker thinks (so a defender can plan)

A tester looks at a system and asks, for each goal: how could this break? Could someone read data they should not (confidentiality)? Change data secretly (integrity)? Take the service down (availability)? This is just a structured way to find weaknesses — the same questions the defender should ask first.

Every attack idea comes with its defence

In this course, every offensive idea is paired with two things: detection (how a defender would notice it) and the fix (how to stop it). That pairing is what makes the knowledge ethical and useful. Learning an attack without its defence is half an education.

Supporting ideas

Two more words you will meet: authentication (proving who you are, like logging in) and authorization (what you are allowed to do once logged in). Many attacks target one of these. Non-repudiation means a user cannot later deny an action, usually because it was logged and signed.