Why this matters
Every account you own and every file you keep is a target. Before you can defend information you need to know what "secure" even means and what you are defending against. This lesson gives you the vocabulary that the rest of security builds on.
The idea
Information security means managing information so it stays safe. It rests on three elements, which you can remember as C‑I‑A:
- Confidentiality: only authorized people can see it.
- Integrity: it isn't altered, destroyed, or tampered with.
- Availability: it's there when you need it.
A threat is anything that breaks one of those. The big families:
- Unauthorized access: getting into a system without permission, often via a stolen ID/password.
- Malware: malicious programs. A virus damages data; a worm copies itself across the network; a trojan horse hides inside a legit-looking program; spyware steals data quietly; ransomware locks your data and demands payment.
- Social engineering: tricking people instead of computers, such as phishing (fake bank emails), impersonation, shoulder surfing, dumpster diving, and card skimming.
Picture it
flowchart TD S[Information security] --> C[Confidentiality] S --> I[Integrity] S --> A[Availability] C -. broken by .-> T1[Leak / unauthorized access] I -. broken by .-> T2[Tampering / malware] A -. broken by .-> T3[Site down / ransomware]
Worked example
A cyberattack knocks a school's website offline. Which C‑I‑A element failed? The data wasn't leaked (confidentiality) or changed (integrity); it just couldn't be reached, so availability broke. Now compare two attacks on a person: an email "from your bank" linking to a fake login page is phishing (a computer trick), while someone reading your password over your shoulder is shoulder surfing, a form of social engineering that needs no malware at all.
Your turn
Try the practice questions. Sort safeguards under the C‑I‑A element they protect, and match each malware name to what it does.
Recap
- Information security = Confidentiality + Integrity + Availability.
- Malware attacks the computer; social engineering attacks the person.
- Name the threat and you're halfway to the right countermeasure (next lesson).