Why security matters: confidentiality, integrity and availability

On a quiet Tuesday in October, Anita Shah opened an email that appeared to come from Ridgeline Coffee Roasters' payroll provider. It asked her to sign in and confirm the company's bank details before the next pay run. The page looked right, the logo looked right, and the deadline was that afternoon. Anita hesitated only because the web address in her browser was slightly wrong, so she phoned Jordan Reyes instead of typing her password. Jordan forwarded the message to Sam Ortiz, the technician from the local IT company who looks after Ridgeline's computers. Sam confirmed what Jordan suspected: it was a phishing page built to steal payroll credentials.

Nothing was lost that day, but the near miss changed how Rosa Delgado, Ridgeline's owner, thought about her business. Ridgeline takes card payments in the cafe, sells coffee online, pays six employees and keeps its books on a desktop computer in the back office. Every one of those activities depends on information that someone outside the business might want to steal, change or disrupt. Rosa asked Sam to carry out a security review, and asked Jordan, who already handles first-line IT support and writes the shop's Python tools, to learn enough security to keep Ridgeline safe between Sam's visits.

This course follows that review. It covers the core ideas every IT role needs: what we are protecting and why, who attacks and how, the controls that stop them, cryptography and certificates, identity, network and device security, monitoring, and responding when something goes wrong. It is written at the level of the CompTIA Security+ certification and builds on the hardware, networking and Linux foundations from NET-101, NET-103 and NET-110. The capstone in lesson 12 brings everything together in a full security review of Ridgeline.

What information security means

Information security is the practice of protecting information, and the systems that store and process it, from harm. Harm can be deliberate, such as a criminal stealing card numbers, or accidental, such as an employee deleting the wrong folder or a failed drive taking the only copy of the accounts with it. Security professionals often use the term cybersecurity for the part of the job that deals with computers and networks, but the goal is broader: a locked office door, a shredder and a clear policy about who may approve payments are security controls too.

A useful way to start is to ask three questions about any piece of information. Who should be able to see it? Who should be able to change it, and how would we know if it had been changed? And when does it need to be available? These three questions map directly onto the three goals at the heart of the field, known as the CIA triad.

Confidentiality

Confidentiality means that information is seen only by the people and systems authorized to see it. Payroll records, customers' card numbers, the supplier price list and the passwords to the online shop are all confidential at Ridgeline. A breach of confidentiality happens when information reaches someone who should not have it: a thief who reads the payroll spreadsheet, a laptop left on a bus, or an email sent to the wrong customer with a spreadsheet attached.

The main tools for confidentiality are access control, which decides who may open what, and encryption, which scrambles data so that it is useless without the right key. Anita's desktop, OFFICE-01, has BitLocker drive encryption switched on, so a burglar who stole the computer could not read the accounts by pulling out the drive. Classification also helps: when everyone knows which information is confidential, they are more careful with it. Ridgeline will use three simple labels in this course: public (the menu, the shop's product pages), internal (staff schedules, roast logs) and confidential (payroll, card data, passwords and anything about customers).

Integrity

Integrity means that information is accurate and complete, and that it is changed only by authorized people in authorized ways. Integrity failures can be harder to notice than confidentiality failures, because the data is still there; it is just wrong. Imagine someone changing the bank account number for Ridgeline's green-coffee importer so that the next payment goes to a criminal's account. Or picture a bug in a spreadsheet macro that quietly doubles every sale on a Saturday, so that Anita's sales tax figures are wrong for months.

Controls for integrity include permissions that stop unauthorized changes, hashing, which produces a fingerprint that changes if a file changes (lesson 5), digital signatures that prove who created something (lesson 6), and audit logs that record who changed what and when (lesson 10). Business processes matter as much as technology. Ridgeline's new rule that any change to a supplier's bank details must be confirmed by phoning the supplier at a known number is an integrity control, and it costs nothing.

A related idea is non-repudiation: being able to prove that a particular person performed an action, so that they cannot later deny it. When Rosa approves a large payment through the bank's website using her own account and a second factor, the bank's records show that she approved it. Shared logins destroy non-repudiation, which is one reason this course will keep returning to the rule that every person gets their own account.

Availability

Availability means that information and systems work when they are needed. For Ridgeline, availability is very concrete. If the point-of-sale tablets cannot reach the payment provider on a Saturday morning, the cafe can only take cash. If the online shop is down during a holiday sale, orders go to competitors. If ransomware encrypts OFFICE-01 the week before payroll, nobody gets paid on time.

Availability is threatened by attacks, such as denial-of-service floods and ransomware, but also by ordinary failures: power cuts, failed drives, expired subscriptions, a tired employee unplugging the wrong cable. Controls include backups, redundancy such as the mirrored drives in the OFFICE-NAS, the uninterruptible power supply in the office, service agreements with providers, and tested plans for working around an outage. Availability is often expressed as the share of time a service is up, but it is easier to understand as allowed downtime. A service that promises 99.9 out of every 100 hours can still be down for almost nine hours a year.

hours_per_year = 365 * 24
for promise in (99.0, 99.9, 99.99):
    down = hours_per_year * (100 - promise) / 100
    print(f"{promise} out of 100: up to {down:.1f} hours down per year ({down * 60:.0f} minutes)")

99.0 out of 100: up to 87.6 hours down per year (5256 minutes)
99.9 out of 100: up to 8.8 hours down per year (526 minutes)
99.99 out of 100: up to 0.9 hours down per year (53 minutes)

def downtime_minutes(promise):
    minutes_per_year = 365 * 24 * 60
    # work out the share of the year the service may be down
    return 0

print(downtime_minutes(99.9))

Balancing the three goals

The three goals often pull against each other. Encrypting everything and requiring long passwords protects confidentiality, but if the only person who knows the encryption key is on holiday, availability suffers. Making the online shop's admin page reachable from anywhere helps availability for Theo, who updates stock from home, but widens the door for attackers. Security work is mostly about finding a sensible balance for each kind of information, based on what matters most to the business.

For Ridgeline's card payments, confidentiality and integrity come first: card data must never be exposed, and amounts must never be altered. For the online shop, availability matters a great deal on busy days. For the roast logs, integrity matters most, because a corrupted log could mean shipping a batch roasted at the wrong temperature. Asking which of the three goals matters most for each asset keeps the review focused.

GOAL = {
    "stolen laptop": "confidentiality",
    # add the other three incidents
}

def goal_for(incident):
    return GOAL[incident]

for i in ["stolen laptop", "changed bank details", "website down", "ransomware"]:
    print(i, "->", goal_for(i))

Assets, threats, vulnerabilities and risk

Four words appear in almost every security conversation, and it pays to use them precisely. An asset is anything of value to the organization: data such as the payroll file, systems such as the point-of-sale tablets, services such as the online shop, and less tangible things such as Ridgeline's reputation in Kelowna, or in Boise for the American branch of this story. A threat is anything that could cause harm to an asset, such as a criminal group sending phishing emails, a burst pipe over the server shelf, or a disgruntled former employee. A vulnerability is a weakness that a threat could exploit, such as an unpatched router, a reused password or an office door that does not lock.

Risk combines the three: it is the chance that a threat will exploit a vulnerability and harm an asset, together with how bad the harm would be. A vulnerability with no realistic threat is a low risk; a serious threat against a well-protected asset may also be a low risk. Lesson 4 turns this into a simple score that Ridgeline uses to decide what to fix first. For now, the key point is that security is about managing risk, not removing it. No small business can afford to remove every risk, and trying to do so would make the business impossible to run.

Why small businesses are targets

Rosa's first reaction to the phishing email was surprise that anyone would bother with a small coffee roaster. It is a common belief, and it is wrong. Most attacks are not aimed at a particular business; they are automated campaigns that send millions of emails or scan every address on the internet for an unpatched device, and they succeed wherever they find a weakness. Small businesses are attractive precisely because they usually have weaker defences than large ones, while still holding money, card data and personal information. Government cybersecurity agencies in both Canada and the United States publish guidance aimed specifically at small organizations for this reason.

Security also matters for reasons beyond direct loss. Ridgeline accepts card payments, so it must follow the Payment Card Industry Data Security Standard (PCI DSS), the security rules that card brands require of every business that handles cards. Privacy laws require Ridgeline to protect customers' and employees' personal information and, in some cases, to report breaches. Customers trust a local business with their details, and that trust is hard to win back. And because Ridgeline's systems connect to its bank, payment provider and suppliers, a compromise at Ridgeline can be used to attack them too.

Security is everyone's job

Sam's first recommendation was not a product. It was a fifteen-minute conversation with every member of staff about the phishing email: what made it convincing, what made Anita pause, and what to do next time. Technology catches a great deal, but people are both the most common target and the most effective sensor. Anita's instinct to check the web address and phone Jordan was worth more than any filter that day.

Throughout this course you will see the same pattern: understand what matters, think about how it could be harmed, put sensible controls in place, watch for problems and be ready to respond. Those five steps scale from a coffee roaster with six staff to a bank with sixty thousand.