Welcome. The first lesson established the authorization boundary for safe testing. This lesson gives you the conceptual frame that everything else attaches to: what security actually is.
The skills in this course only make sense once you can answer a basic question: what are we protecting, and from what?
In this lesson you will:
- Learn what makes security different from ordinary reliability — there is an intelligent adversary who is trying to make the system fail.
- Meet the CIA triad — confidentiality, integrity, and availability — the three properties by which security is measured.
- Learn the core vocabulary every later lesson assumes: asset, threat, threat actor, vulnerability, exploit, payload, attack surface, and risk.
- Understand the attacker-versus-defender mindset and the single idea behind almost every web vulnerability: the client is attacker-controlled.
Security, in one sentence
Information security is the practice of keeping systems and their data trustworthy in the face of people who actively want them to fail. Unlike a bridge resisting the wind, a system under attack faces a thinking opponent who probes every assumption and combines small flaws into large ones.
The CIA triad
"Trustworthy" breaks into three properties:
- Confidentiality — only authorized parties can see the information.
- Integrity — the information and the system have not been tampered with.
- Availability — legitimate users can use the system when they need it.
Almost any incident you read about can be classified by which leg it broke — a data leak is a confidentiality failure, a defacement an integrity failure, an outage an availability failure. Two more properties are often added: authenticity (you know who you are dealing with) and non-repudiation (a party cannot deny what they did).
This lesson is reflective rather than offensive — there is nothing to exploit here, only the frame that makes the rest of the course comprehensible.
Estimated time: 10 minutes.
When you are ready, send the Continue signal.