Week 01 · lesson
Authorization, Ethics, and the CIA Triad
Cybersecurity has a simple problem: people often jump straight to tools before they can explain what they are trying to protect.
The Garden State Cyber course starts with a better question:
What would failure look like for the information or system we care about?
One of the most useful models for answering that is the CIA Triad:
- Confidentiality: only the right people should be able to access the information.
- Integrity: the information should remain accurate, complete, and trustworthy.
- Availability: the information or service should be accessible when authorized users need it.
The words are simple. The hard part is recognizing that the same system can fail in three very different ways.
Turn a vague security problem into a defensible control
Start with the asset and failure, name the CIA property at risk, choose a matching control, then verify the result with evidence.
- ASSETwhat information, account, device, or service matters?can fail as
- FAILUREwhat specifically could go wrong?threatens
- CIA PROPERTYconfidentiality, integrity, availability, or more than onematch
- CONTROLa safeguard that addresses that exact failureverify
- EVIDENCEobservable proof that the control changed the state
Use this flow throughout the course whenever a security question feels vague. Start with the asset and failure, identify the property at risk, then choose a control and evidence that can actually verify the change.
One system, three different failures
Imagine a school robotics team stores its competition code in a shared online repository.
Confidentiality failure
A student accidentally makes a private planning document public. People outside the team can now read information that was intended only for the team.
The system may still work. The code may still be correct. The problem is that access is too broad.
Integrity failure
A configuration file is changed without authorization. The robot now behaves differently because the file no longer contains the trusted settings the team approved.
The data is still available. The problem is that it can no longer be trusted.
Availability failure
The repository is unreachable right before a competition. The code may be private and perfectly accurate, but the team cannot access it when it is needed.
That is an availability problem.
Security decisions become clearer when you name the property that is being threatened.
Do not force every problem into one letter
Real incidents can affect more than one part of the triad.
Suppose a laptop is stolen.
- Confidentiality may be affected if the device stores sensitive files.
- Integrity may be affected if someone can alter files or settings.
- Availability may be affected because the authorized user no longer has the device.
The goal is not to pick exactly one letter. The goal is to explain the effect precisely.
Match controls to the failure
A control is useful only if it addresses the problem you identified.
| Security problem | Possible control | Why it helps |
|---|---|---|
| Unauthorized people can read a file | Access permissions | Limits who can view the file |
| A password is exposed | Multi-factor authentication | Adds another verification step |
| A configuration file is changed | Version history and review | Makes unauthorized or incorrect changes easier to detect and reverse |
| A laptop fails | Backup copy | Preserves access to important data |
| A service becomes unavailable | Redundancy or recovery plan | Gives users another way to restore access |
A backup does not prevent someone from reading a confidential file. Encryption does not guarantee that a server will stay online. Multi-factor authentication does not repair corrupted data.
Defenders need to connect the control to the failure.
Ethics is part of the model
The CIA Triad tells you what you want to protect. It does not give you permission to test any system you want.
Suppose you believe a school website has an availability weakness. You are still not authorized to stress-test the site.
Suppose you think a classmate's password is weak. You are still not authorized to try logging into the account.
A security goal does not cancel the authorization boundary from Lesson 1.
Use this rule throughout the course:
A defensive purpose does not make an unauthorized action acceptable.
Build a CIA map
Use the fictional classroom systems below.
For each system, identify one confidentiality risk, one integrity risk, and one availability risk.
| System | Confidentiality risk | Integrity risk | Availability risk |
|---|---|---|---|
| Shared class drive | |||
| Robotics team laptop | |||
| Student account | |||
| School announcement website |
Do not write the same generic answer in every cell.
Weak:
Hackers could attack it.
Stronger:
The shared drive could expose student contact information if folder permissions are set to public.
The second answer identifies the system, the information, and the security property at risk.
A worked case: the altered spreadsheet
A teacher provides this fictional incident:
A team tracks equipment inventory in a shared spreadsheet. A student notices that several quantities changed overnight. The file is still accessible, and there is no evidence that unauthorized people viewed it.
What part of the CIA Triad is most directly affected?
Integrity.
Why not confidentiality?
Because the scenario does not provide evidence that unauthorized people read the file.
Why not availability?
Because the file is still accessible.
What evidence would help next?
- version history
- authorized editor list
- timestamp of the changes
- previous trusted copy
Notice the difference between a security claim and an assumption. The evidence supports the claim that the data changed. It does not yet prove who changed it or why.
Careers use the same reasoning
Cybersecurity is not one job.
Different roles may focus on different parts of the same problem:
- a security analyst may review alerts and evidence
- a security engineer may design controls
- a network defender may protect traffic and services
- an incident responder may investigate what happened
- a governance or risk professional may define policy and acceptable risk
- a digital forensics analyst may preserve and examine evidence
The tools vary, but the reasoning does not. Every role has to understand what is being protected, what evidence exists, what action is authorized, and what failure the control is meant to reduce.
Your task: make the failure visible
Choose one fictional system:
- robotics team repository
- student Chromebook
- school Wi-Fi account
- class shared drive
- competition registration portal
Create a CIA Protection Card with these sections:
Asset
What information, account, device, or service matters?
Confidentiality
What should remain private, and who should be allowed to access it?
Integrity
What must remain accurate or trustworthy?
Availability
When must the system or information be accessible?
Controls
Choose one control for each CIA property. Explain why that control matches the failure you identified.
Authorization boundary
Name one tempting action that would still require permission before you could use it to test the system.
Check your reasoning
Before you submit, challenge your own work:
- Did I identify a specific asset instead of saying "the system"?
- Did I explain the effect on confidentiality, integrity, or availability?
- Does each control solve the problem I attached it to?
- Did I avoid claiming evidence I do not have?
- Did I keep testing actions inside the approved classroom scope?
Evidence for Lesson 2
Submit your completed CIA Protection Card.
Finish with three short statements:
- The CIA property I first underestimated was...
- The control that best matches that failure is... because...
- A security action I would still need permission to perform is...
The CIA Triad is not the whole field of cybersecurity. It is the first lens that helps you stop saying "secure it" and start explaining what needs protection and why.