Why this matters
Interviewers for security roles in Ghana often ask you to explain the CIA triad, and you will use its words in every incident note you write. Risk is the other half: no organisation can fix everything at once, so analysts help decide what to fix first.
The CIA triad
Confidentiality means only the right people can see information. A customer's mobile money balance, a patient's test result and staff salaries should stay private. A leaked customer list is a confidentiality failure.
Integrity means information is accurate and has not been changed without permission. If someone edits a loan record so a balance looks paid, integrity has failed, even if nobody else saw the record.
Availability means systems and data are there when people need them. If a hospital's records system is down on a busy morning, or ransomware locks a shop's sales files, availability has failed.
Different incidents hit different parts of the triad. A good analyst names which part, because it shapes the response.
Threats, vulnerabilities and risk
These three words are often mixed up. Keep them separate:
- A threat is something that could cause harm: a fraudster, a virus, a flood, a careless insider.
- A vulnerability is a weakness that a threat could use: a weak password, a missing update, staff who have never seen a phishing message.