What Security Actually Protects

Security is about protecting three things: secrets, correctness, and uptime. Learn to spot what's at risk before reaching for a fix.

What you will learn

Explain the CIA triad: confidentiality, integrity, availability
Give a real example attack for each part of the triad
Describe threat modelling as asking who, what, and how much it would hurt
Model a simple risk check as a JavaScript function

The idea

Security is not one thing — it is three goals people mix up constantly. Confidentiality means only the right people can read data. Integrity means data can't be tampered with unnoticed. Availability means the system stays up and usable when people need it. Every attack targets at least one of these three.

Why does this matter?

If you only think about hackers stealing secrets, you will miss attacks that corrupt data (integrity) or take a site offline (availability). Naming the goal you are protecting tells you what defenses actually matter for a given system.

A real-world analogy

Think of a bank vault. Confidentiality is the lock that keeps strangers from seeing the cash. Integrity is the tamper-proof seal on each bag so no one can secretly swap real bills for fakes. Availability is the vault door actually opening when a teller needs it during business hours. A vault that never opens is technically very confidential — and completely useless.

See it in code

Modelling the CIA triad as data

const incidents = [
  { name: "Leaked customer emails", type: "confidentiality" },
  { name: "Attacker edited someone else's order total", type: "integrity" },
  { name: "Site knocked offline by traffic flood", type: "availability" }
];

function classify(incident) {
  return `${incident.name} -> breaks ${incident.type}`;
}

incidents.forEach(i => console.log(classify(i)));

Line by line

const incidents = [...]
Each incident is tagged with which CIA property it violates — this is how security people triage real reports.
function classify(incident) { ... }
A pure function that just reads data and returns a string — no side effects, easy to test.
incidents.forEach(i => console.log(classify(i)));
Loops over each incident and prints which triad property was broken.

What do you think happens?

An attacker floods a hospital's patient-records server with junk traffic so doctors can't load charts during an emergency. Which part of the CIA triad is being attacked?

Have a guess before you read on. Guessing wrong is part of learning it.

Try it yourself

Write a function worstRisk(incidents) that takes an array of {name, severity} objects and returns the name of the one with the highest severity number.

Worth knowing

Common mistake: treating security as only "stopping hackers from stealing data." A system that is 100% locked down but crashes constantly has failed at availability — that's still a security failure.

The proper words for it

CIA triad: The three goals of security: Confidentiality, Integrity, Availability.
Threat model: A structured guess at who might attack a system, how, and how much damage it would cause.
Denial of service (DoS): An attack that makes a system unavailable, e.g. by overwhelming it with traffic.

Where you'll meet this

In 2017, Equifax lost 147 million people's data (confidentiality breach) due to an unpatched web framework — one bug, but it broke public trust for years. Meanwhile, ransomware attacks target availability and integrity by encrypting files until a ransom is paid.

Lesson recap

Security has three goals: confidentiality, integrity, availability
Every attack breaks at least one of these
Threat modelling means asking who might attack, how, and what it would cost
Naming which goal is at risk tells you which defense actually helps