Computer Security Basics: The CIA Triad and Core Principles

Computer security is the practice of protecting your devices, accounts, and data from theft, damage, and unauthorized access. It rests on one model – the CIA triad (keep data private, unchanged, and reachable) – and on a short list of everyday habits: strong unique passwords, two-factor login, updates, backups, antivirus, and a healthy suspicion of links. You will not eliminate every risk, but you can make yourself a far harder target.

What Is Computer Security?

Computer security is the discipline of protecting information systems and the data they hold by applying controls – technical, administrative, and physical:

• The goal is risk reduction, not zero risk: you lower risk to a level you can accept, not to nothing – perfect security does not exist.
• It protects three asset types: hardware (the physical devices), software (the operating system, apps, and firmware), and data (information stored, processed, and sent).
• Why it matters: the IBM Cost of a Data Breach Report 2023 put the average breach at $4.45 million, with healthcare highest at $10.93 million per incident.

What Is the CIA Triad?

The CIA triad is the foundational model of security: every secure system must protect Confidentiality, Integrity, and Availability. Every control you ever set up exists to defend one or more of these three:

What Are the Most Common Threats?

Most attacks on a normal user fall into a few familiar buckets – knowing the type points you at the defense:

• Malware: malicious software – viruses, worms, trojans, ransomware, spyware. It spreads through downloads, email attachments, and hacked sites; ransomware encrypts your files for payment, spyware quietly steals your logins.
• Phishing and social engineering: emails, texts, calls, and QR codes that trick you into handing over a password or running a file. It targets the person, not the machine – and it is the single most common way breaches start.
• Weak or reused passwords: attackers test leaked and guessable passwords across sites (credential stuffing). One reused password can unlock many accounts.
• Network and physical attacks: snooping on unsecured Wi-Fi (man-in-the-middle), plus old-fashioned theft of an unlocked laptop or a stray USB stick.

How Do You Secure Your PC? The 6 Core Defenses

Set these up once, in order, and you cover the large majority of real-world threats. Each step counters specific attacks from the list above:

• Use a password manager. Let it generate a long, unique password for every account – you memorize only one. This kills password reuse, the biggest avoidable risk.
• Turn on two-factor authentication (2FA/MFA). Add a second proof – an authenticator app or a hardware key – so a stolen password alone is useless. Apps and keys beat SMS, which can be hijacked by SIM swapping. Do email and banking first.
• Enable automatic updates. Patch your operating system, browser, apps, and router. Updates close the known holes that malware is built to exploit.
• Back up your files (3-2-1). Keep 3 copies, on 2 types of media, with 1 off-site or offline. A disconnected backup is your guaranteed recovery from ransomware or a dead drive.
• Run antivirus and keep it on. Reputable security software (Windows ships Microsoft Defender) catches known malware; its definitions update constantly.
• Keep the firewall on and browse safely. The firewall blocks unsolicited inbound connections. Download only from official sources, distrust urgent links and attachments, and use WPA2/WPA3 Wi-Fi with a strong password.

What Is an Attack Surface?

An attack surface is the total set of points where someone could try to break in or pull data out – a smaller surface means fewer ways in. It has three parts:

• Digital: open network ports, web and API endpoints, software flaws, and misconfigured services reachable over a network.
• Physical: server rooms, USB ports, exposed hardware, unattended workstations, and physical media such as hard drives.
• Social: people who can be manipulated through phishing or impersonation into giving up credentials – which is why the operating system alone cannot keep you safe.

Threat vs. Vulnerability vs. Risk: What Is the Difference?

These three terms are distinct, and security pros never use them interchangeably:

• Threat: a potential event or actor that could cause harm – a ransomware group, a disgruntled employee, a flood. Threats are outside your system.
• Vulnerability: a weakness a threat can exploit – an unpatched software flaw, a weak password policy, an unlocked server room.
• Risk: the chance a threat exploits a vulnerability and the damage if it does. Risk = threat x vulnerability x impact – you measure and prioritize it, you do not erase it.

What Are the 5 Primary Threat Categories?

Professionals group threats into five categories by where they come from and how they work:

• Malware: viruses, worms, trojans, ransomware, spyware – unauthorized code that steals data, encrypts files, or sets up persistent access.
• Social engineering: psychological manipulation (phishing above all) to make a user hand over access. Phishing accounts for a large share of breaches (Verizon DBIR 2023).
• Network attacks: man-in-the-middle, DDoS, ARP spoofing, DNS poisoning, and packet sniffing against network infrastructure.
• Insider threats: current or former staff and contractors with legitimate access – malicious (intentional) or negligent (accidental).
• Physical threats: theft, tampering, and unauthorized physical access that bypass every software control if not separately blocked.

What Is Defense in Depth?

Defense in depth is a layered strategy: stack multiple independent controls so the failure of one does not bring down the whole system. The idea comes from military strategy – each line an attacker must beat on its own:

• Physical and perimeter: locked rooms and badge access on the outside; firewalls and intrusion detection at the network edge.
• Internal and host: network segmentation and zero-trust access inside; endpoint protection, host firewalls, and patching on each machine.
• Application, data, and identity: secure coding and web application firewalls; encryption at rest (AES-256) and in transit (TLS 1.3); and MFA plus privileged-access management for users.

What Are the 6 Foundational Security Principles?

Six principles, first set out by Jerome Saltzer and Michael Schroeder in 1975, still define sound security design:

• Least privilege: every user and process gets only the permissions it needs – this shrinks the blast radius if it is compromised.
• Separation of duties: no one person can complete a sensitive action alone, which blocks fraud and catches errors.
• Defense in depth: multiple independent layers, so no single failure compromises everything.
• Fail-safe defaults: when in doubt, deny – a misconfigured firewall should block all traffic, not allow it.
• Open design: security must not depend on keeping the design secret. AES and RSA are public yet secure because strength lives in the key, not the algorithm.
• Complete mediation: check every access to every object every time, not just at login – this stops session hijacking and cached-credential attacks.

Security vs. Usability: The Fundamental Trade-Off

More security almost always means less convenience – and the right balance depends on what you are protecting:

• Too little: a system with no passwords is effortless to use and has zero confidentiality.
• Too much: 20-character passwords, biometric MFA, and a 5-minute session timeout are highly secure but practically unusable.
• The balance: security policy picks the acceptable point based on asset value, the threat environment, and regulations such as GDPR, HIPAA, and PCI-DSS.

Comparison of Attack Categories

This table sums up how the five attack categories compare on target, CIA impact, primary defense, and how hard each is to detect:

Last Thoughts on Computer Security Basics

Computer security comes down to one model and a handful of habits. The CIA triad – keep data private, intact, and reachable – tells you what you are protecting; threat-vulnerability-risk analysis tells you what to prioritize; and layered defenses governed by six principles tell you how to build it.

No system is ever fully secure, so the aim is to be a harder target than the next one. Set up a password manager, turn on two-factor authentication, keep everything updated, back up on the 3-2-1 rule, run antivirus, and think before you click – that combination stops the large majority of real attacks.

Key Takeaways:

• The CIA triad is the core. Confidentiality, Integrity, and Availability are the three properties every secure system must keep – private, unchanged, reachable.
• Six habits do most of the work. A password manager, two-factor authentication, automatic updates, 3-2-1 backups, antivirus, and safe browsing counter the most common threats together.
• Know the difference. A threat exploits a vulnerability; risk is threat x vulnerability x impact – measured and prioritized, never fully erased.
• Layer your defenses. Defense in depth stacks independent controls so one failure never compromises the whole system.
• Security trades against convenience. Pick the balance that fits the value of what you are protecting – perfect security is neither possible nor usable.

Frequently Asked Questions (FAQs)