⚠ Image-backend outage: the AI render route was unavailable for this run (provider credits exhausted), so today's card ships in text + CSS only. The infographic will return with the next funded run.
Cybersecurity Foundations: CIA Triad, Threat Models, and Defense in Depth
Name the asset before you buy a tool.
The triad — what can be harmed
- Confidentiality: secrets stay unseen
- Integrity: no silent edits
- Availability: work still completes
- One asset, three distinct harms
- The triad is a question, not a wall
Threat model — how harm arrives
- Name the asset first
- Name an adversary and their capability
- Map the attack surface between them
- Give each path a failure objective
- Business impact sizes the risk
Triad = what can be harmed
Threat model = who, how, through where
Worked trace — a payroll export
- Salary leak = confidentiality break
- Edited bank detail = integrity break
- Missed payday run = availability break
- Each break needs its own detection
Defense in depth — independent layers
- Before: least privilege, encryption
- During: validation, immutable audit logs
- After: backups, recovery drills
- Layers must fail separately
Honest test — falsify the design
- Remove one layer at a time
- Can one stolen credential still read?
- Still write? Still destroy?
- All yes: many products, one boundary
Habits, not controls. “Think like an attacker” is incomplete without business impact — and never-stop-learning is a habit, not a security control.