Mission 06
Cybersecurity Fundamentals
Cybersecurity rests on a few simple ideas: keep information private, accurate and available, understand risk in plain words, and use several layers of people, process and technology so one failure does not become a crisis.
In this mission you will
- Explain confidentiality, integrity and availability using everyday business examples.
- Describe risk as a combination of threat, vulnerability and impact, in plain words.
- Classify a safeguard as a people, process or technology control.
- Apply least privilege and defence in depth to one business workflow.
Three questions about any information
Security professionals often talk about the CIA triad. It has nothing to do with spies. It is a simple way to ask three questions about anything your business relies on. Who should be able to see it? Can we trust that it is correct? Can we get to it when we need it? Almost every cyber problem damages one or more of these three things.
The CIA triad in a small business
- Confidentiality: only the right people can see the information. A customer list sent to the wrong WhatsApp group is a confidentiality failure.
- Integrity: the information is accurate and only changed by the right people in the right way. A supplier’s bank details quietly changed in your accounts software is an integrity failure.
- Availability: the information and systems work when you need them. A laptop locked by ransomware on the day of GST filing is an availability failure.
Risk in plain words
Risk is a way of deciding what to worry about first. Think of it as three parts multiplied together. A threat is someone or something that could cause harm, such as a fraudster, a careless mistake or a power surge. A vulnerability is a weakness they could use, such as a reused password, an unpatched laptop or no second approval for payments. Impact is how badly the business would be hurt if it happened. If any one of the three is close to zero, the risk is small. If all three are high, that is where to act first.
Three kinds of controls
- People controls: knowledge and habits, such as pausing to verify an urgent payment request or reporting an odd email.
- Process controls: agreed rules and steps, such as a second approver for new beneficiaries or a joiner-leaver checklist for access.
- Technology controls: settings and tools, such as multi-factor authentication, automatic updates, backups and antivirus.
Least privilege and defence in depth
Least privilege means giving each person, device or app only the access it needs for its approved job, and no more. The sales executive does not need admin rights to the accounting software. The intern does not need the banking login. Less access means less damage if an account is misused. Defence in depth means using several layers so that if one fails, another still helps. A phishing email might get past the spam filter, but a trained employee spots it. If they click, MFA blocks the login. If something still goes wrong, a tested backup lets you recover. No single layer is perfect, so you stack them.
Practical business example
Mehta Tiles and the overwritten price list
Mehta Tiles, a fictional 18-person tile showroom in Ahmedabad, kept its approved dealer price list in one spreadsheet on the sales manager’s laptop, shared with the whole team. On a busy Monday, a new sales executive, Karan, opened the file to prepare a quote and accidentally typed over a whole column of prices before saving. Nobody noticed for two days. Three quotations went out at the wrong rates. When the owner, Nilesh, tried to restore the old version, he found there was no backup. The team rebuilt the list from old emails over a weekend. Nilesh did not blame Karan. Instead, the team used the CIA triad to review what happened. They moved the price list to a cloud drive with version history, gave edit rights only to the sales manager and owner, and gave everyone else view-only access. They also agreed that any price change is checked by a second person before it is shared with dealers.
The lesson: One honest mistake damaged integrity and then availability, because there was a single editable copy and no backup. Least privilege, version history and a simple review step now give three layers of protection.
Key takeaways
- Use the CIA triad to ask three questions about anything important: who can see it, can we trust it, and can we reach it when needed?
- Risk combines threat, vulnerability and impact. Focus first where all three are high.
- Controls come in three kinds: people, process and technology. Strong protection uses all three.
- Least privilege limits the damage from mistakes and misuse by giving only the access each role needs.
- Defence in depth stacks several layers so one failure does not become a crisis. No single layer makes a business fully secure.
Scenario lab · +25 XP
The price list that changed overnight
You work at Lakshmi Hardware, a fictional 12-person hardware wholesaler in Coimbatore. The approved price list is stored as a spreadsheet in a shared folder that every employee can edit. This morning, a dealer calls to say the prices on yesterday’s quotation look far too low. You open the file and see that many prices have been changed, but you do not know by whom or when.
Fictional scenario. Never enter real passwords, OTPs or customer details anywhere in this course.
Decision 1 of 3
Which part of the CIA triad has been affected first?
Knowledge check · +20 XP on mastery
Check your understanding
Practical action · +40 XP (self-reported)
Run a CIA check on one process
Pick one everyday business process, such as raising invoices, paying suppliers or updating prices, and look at it through the CIA triad. Use general descriptions only. Do not record any passwords, account numbers or customer details.
- 1.Write the process name and the main information or system it depends on.
- 2.Note one confidentiality risk: who could see this information who should not?
- 3.Note one integrity risk: how could this information be changed wrongly, by mistake or on purpose?
- 4.Note one availability risk: what would stop you using it when you need it?
- 5.For each risk, suggest one people, process or technology control that would help.
- 6.Check who has edit or admin access to this system and note anyone whose access could be reduced.
Do this in your own records. Don’t enter passwords, OTPs, customer data or incident details here.
Mission status: Not started
A mission is complete when you have read the lesson, answered the knowledge check and acknowledged the practical action. Mastery means scoring at least 3 of 4 on the knowledge check.
View my progress