What are we protecting?

Cyber security is the practice of protecting information and the systems that handle it from harm. This lab is entirely about defence: how to notice problems, how to reduce them and how to recover. You will not find attack recipes here, and the threats you meet are shown as shapes and signals, never as instructions.

Every company, person, e-mail address and web address in this lab is invented. Addresses ending in .example or .test and the number blocks 192.0.2.x, 198.51.100.x and 203.0.113.x are reserved for documentation, so they never point at a real place.

Before we can defend anything, we need to say what "protected" means. Security people use three words, known as the CIA triad (nothing to do with any agency):

• Confidentiality: only the people who are allowed to see the information can see it.
• Integrity: the information has not been changed by someone who should not change it, and you can tell if it has.
• Availability: the system and the information work when the right people need them.

One real-world event can damage one pillar, two, or all three. A few examples, all invented:

Notice that no secret has to leak for security to fail. A web page that cannot be reached is a security problem too, even though nothing was stolen.

Different systems rank the pillars differently. There is no single right order.

• A photo album on your phone: confidentiality matters a lot (private pictures), availability less (you can wait a day).
• A hospital's medication system: integrity is critical (a changed dose can hurt someone) and availability too (nurses need it right now).
• A public weather site: confidentiality hardly matters, because the data is meant to be public, but integrity and availability do.

Good defenders begin every project by asking: which of the three matters most here, and what would a failure look like? The answer decides where to spend time and money.