The Language of Security: CIA, Threats, Vulnerabilities and Risk

What you'll be able to do

By the end of this lesson you will be able to use confidentiality, integrity, availability, threat, vulnerability, exploit and risk correctly to describe an incident.

• Sort the damage from any incident into confidentiality, integrity and availability.
• Tell a threat, a vulnerability and an exploit apart in a real situation.
• Judge risk by asking two questions: how likely is it, and how bad would it be?

Dr. Al-Doori does not teach these words as a list to memorise. In Chapter 2 he lets them surface through true stories, and you will meet those stories in the next two lessons. This lesson gives you the vocabulary first, so you can recognise each term when it appears.

The CIA Triad: What Security Protects

Almost everything in security comes back to three properties, known together as the CIA triad. (Nothing to do with the intelligence agency.) The US federal definition of information security is still framed around these same three.

• Confidentiality. Only the right people can see the information. Your private messages being read by a stranger is a confidentiality failure.
• Integrity. The information is accurate and has not been tampered with. Someone posting from your account, or changing the bank details on an invoice, is an integrity failure.
• Availability. The right people can get to the information when they need it. Being locked out of your own account, or a website knocked offline, is an availability failure.

A useful habit: whenever you hear about an incident, ask which of the three was broken? Often it is more than one. A stolen, unencrypted laptop breaks confidentiality (a thief can read the files) and availability (you can no longer use them) at the same time.

Threats, Vulnerabilities and Exploits

These three words are often mixed up, so take them one at a time.

• A vulnerability is a weak point: a software flaw that has not been fixed, a reused password, a support desk that will reset an account for anyone who sounds convincing.
• A threat is something that could cause harm by taking advantage of a weak point. NIST, the US standards body, defines it as a circumstance or event with the potential to harm. A phishing campaign, a burglar or a disgruntled insider are all threats.
• An exploit is the actual method used to take advantage of a vulnerability: a piece of attack code, or simply a clever trick. Exploits do not have to be technical. A convincing phone call can be an exploit.

Two more terms come up constantly. The impact is what happens if an attack succeeds: lost photos, stolen money, a damaged reputation. A script kiddie is an attacker with little real skill who uses tools and instructions written by others. Script kiddies matter because so many attacks need no expertise at all, which is one reason ordinary people are such common victims.

Risk: How Likely, and How Bad?

Risk is how worried you should be about something. Dr. Al-Doori teaches it as a combination of three ingredients: vulnerability, threat and impact. Reduce any one of them, and you reduce the overall risk.

Today, NIST frames risk with two questions. How likely is the harmful event? And how bad would the impact be? Likelihood depends on the threats you face and the vulnerabilities you have. Put together, it looks like this:

• Lower the likelihood by closing vulnerabilities: install updates, use unique passwords, turn on a second sign-in step.
• Lower the impact by planning for failure: keep backups, keep important accounts separate, limit what is stored where.

You will use this two-question test throughout the course. When something feels risky, ask how likely it is and how bad it would be, then decide which of the two you can shrink.

Real-World Example

Imagine a small community sports club (a fictional scenario). Its members' website runs on software that has not been updated for two years. A published flaw in that software is well known. An attacker with little skill downloads a ready-made tool that targets it, breaks in, changes the training schedule, copies the members' contact list and leaves the site crashed.

In security language:

• The vulnerability is the unpatched software. The exploit is the ready-made tool. The attacker is a script kiddie, and the threat is anyone scanning the Internet for that known flaw.
• Integrity broke when the schedule was changed. Confidentiality broke when the contact list was copied. Availability broke when the site went down.
• The club could have lowered the likelihood by installing updates, and lowered the impact by keeping a backup of the site and collecting less member data.

From the Book to 2026

What the book teaches. Risk combines vulnerability, threat and impact, and the book describes the threat as the likelihood of a given attack. You lower risk by reducing any of the three.

Why it made sense. It is a clear, practical model. It tells beginners that risk is not fixed, and that they can act on several fronts at once.

What has changed. Security guidance has evolved since the original text. Mainstream definitions, such as NIST's, now describe risk as a function of likelihood and impact. They treat a threat as the event or circumstance that could cause harm, rather than as a probability. The likelihood then depends on both the threats and the vulnerabilities.

What to do now. Keep the book's three ingredients as a helpful simplification. They point you to the right levers. When you assess a situation, use today's two questions, "how likely?" and "how bad?", and remember that closing vulnerabilities lowers likelihood, while backups and separation lower impact.

Watch: What is the CIA Triad

This short whiteboard explainer walks through confidentiality, integrity and availability with simple diagrams. It is a quick way to lock in the triad before the case studies.

As you watch, notice:

• How confidentiality is enforced with tools you will meet later in the course, such as authentication, multi-factor authentication and encryption, letting the authorized user in and blocking everyone else.
• The integrity examples: an order quietly changed from 100 widgets to a much larger number, and an attacker editing a log file to erase signs that they were ever there.
• The suggestion to use the triad as a checklist: for any new project, ask whether you have covered all three.

The video reinforces what you just read — the lesson is complete without it.

What Would You Do?

Your home Wi-Fi still uses the password printed on the router's sticker, and a visitor photographed that sticker last month. Name the vulnerability and a possible threat, and choose the single change that lowers the risk most.

Knowledge Check

Key Takeaways

• Security protects confidentiality, integrity and availability, and one incident often breaks more than one.
• A vulnerability is the weak point, a threat is what could cause harm, and an exploit is the method that takes advantage of the weak point.
• Many attacks need no expertise; a script kiddie with a ready-made tool is enough.
• Judge risk by likelihood and impact: close vulnerabilities to lower likelihood, keep backups to lower impact.

Sources

• NIST Computer Security Resource Center — Glossary: information security
• NIST Computer Security Resource Center — Glossary: risk
• NIST Computer Security Resource Center — Glossary: threat
• Dr. Tahseen Al-Doori — Cyber Security Essentials (Second Edition, 2026), Chapter 2