Essential Security Principles · Topic 1 of 5
Security Principles, CIA and Defence in Depth
Learn the core security terms, the CIA triad, hardening, defence in depth, types of attackers, their motives and the code of ethics for security staff.
- 5 min
- Includes a diagram
- A vulnerability is a weakness, a threat is something that could use it, and an exploit is the method used.
- Risk combines likelihood and impact.
- CIA stands for confidentiality, integrity and availability.
What it is
Security principles are the shared vocabulary and ideas that every later topic builds on.
Before you can protect a system, you need to know what you are protecting it from. You also need to know why anyone would attack it, and what rules you must follow while defending it.
This page defines the four core terms, the three goals of security, and the ideas of hardening and layered defence. It ends with who attacks, why, and how a professional behaves.
How it works
The terms fit together in a chain, and the controls you choose aim to break that chain.
The four core terms
| Term | Meaning | Example |
|---|---|---|
| Vulnerability | A weakness that could be misused | An unpatched server |
| Threat | Anything that could cause harm by using a weakness | A criminal group or a piece of malware |
| Exploit | A method or tool that takes advantage of a vulnerability | A script that abuses the unpatched flaw |
| Risk | The chance that a threat uses a vulnerability, combined with the damage it would cause | A high chance of data theft from that server |
A vulnerability on its own is not an attack. Risk appears only when a threat can reach the weakness and the loss would matter.
An attack vector is the path an attacker uses to reach the target. Common vectors include email attachments, malicious websites, removable USB drives, open wireless networks, weak passwords and software from untrusted suppliers.
Hardening and defence in depth
Hardening means making a system harder to attack by reducing its attack surface. Typical steps are:
- removing or disabling services and accounts you do not need
- changing default passwords and settings
- applying patches and updates
- giving users only the access they need, which is called least privilege
- turning on logging and a host firewall
Defence in depth means using several layers of protection, so that one failure does not expose everything. Think of a castle with a moat, a wall and guards. If an attacker gets past the email filter, the endpoint protection, the firewall and the access controls can still stop the damage.
Layers are usually grouped as physical, network, endpoint, application and data, with people and policy around all of them.
The CIA triad
Confidentiality, integrity and availability are the three goals of security.
| Goal | Meaning | Control examples | Typical attack |
|---|---|---|---|
| Confidentiality | Only authorised people can read the data | Encryption, access control | Data theft |
| Integrity | Data stays accurate and unaltered | Hashing, digital signatures | Tampering |
| Availability | Systems and data are usable when needed | Backups, redundancy | Denial of service |
When you read an exam scenario, ask which of the three goals was harmed. A leaked customer list harms confidentiality, a changed bank balance harms integrity, and a website that is down harms availability.
Types of attackers and their reasons
| Attacker type | Description |
|---|---|
| Script kiddie | Unskilled person who runs tools made by others |
| Hacktivist | Attacks to support a political or social cause |
| Cybercriminal | Attacks for money, often in organised groups |
| Insider | Employee or contractor who misuses legitimate access |
| Nation state | Government backed group with large resources, often linked to espionage |
| Competitor | Business that wants trade secrets |
Common reasons for attacks are financial gain, stealing information (espionage), disruption, political or social beliefs, revenge and the wish for fame or a challenge.
Code of ethics
Cybersecurity staff hold powerful skills, so they follow a code of ethics. In plain terms, this means:
- act only with the owner's permission, ideally in writing
- protect the privacy and confidentiality of the data you see
- be honest and report what you find accurately
- avoid causing harm and follow the law
- report weaknesses responsibly to the people who can fix them
Testing a system without permission is illegal, even when the intention is good. The difference between an ethical tester and an attacker is authorisation.
What to remember for the exam
Seven facts cover most questions on this topic.
- A vulnerability is a weakness, a threat is something that could use it, and an exploit is the method used.
- Risk combines likelihood and impact.
- CIA stands for confidentiality, integrity and availability.
- Hardening reduces the attack surface by removing, changing and updating things.
- Defence in depth uses several layers, so no single control is relied on alone.
- Hacktivists act for a cause, cybercriminals for money, and nation state attackers for espionage or strategic goals.
- Ethical work needs permission and respect for privacy.
Match the harm to the letter. Secret leaked is confidentiality, data changed is integrity, service down is availability.
Common mistakes
These four errors catch many candidates.
Mixing up threat and vulnerability. The threat is the actor or event, and the vulnerability is the weakness. A missing patch is a vulnerability, not a threat.
Treating risk as the same as vulnerability. A weakness that nobody can reach, or that protects nothing valuable, is a low risk.
Thinking one strong control is enough. A single firewall is not defence in depth. Layers are what give the protection.
Assuming only outsiders attack. Insiders already have access, so their misuse can be harder to notice.
Testing a network you do not own, without written permission, breaks the code of ethics and is likely to be a crime.
Check yourself
Work through these three questions.
What is the difference between a vulnerability and an exploit?
A vulnerability is a weakness in a system. An exploit is the method or tool that takes advantage of that weakness.
Which part of CIA is harmed when a website is knocked offline?
Availability is harmed, because the system is not usable when people need it.
Why is defence in depth better than one strong control?
It uses several layers, so if one layer fails the others can still protect the system.
Topic 1 of 5 in Essential Security Principles
Test yourself on Essential Security Principles
The full Cisco CCST 100-160 Cybersecurity question bank has 864 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.