Last updated · reviewed for accuracy
CIA triad & common attacks
Security sounds like a specialist subject until you realise every helpdesk ticket about a hacked account, a slow site or a corrupted file is one of three failures. Name the failure and the defence usually names itself.
The CIA triad: three promises every network makes
Confidentiality means only authorised parties can read data. Integrity means data cannot be altered undetected. Availability means systems are reachable when needed. Every security control you will ever deploy protects at least one of the three.
| Promise | Broken looks like | Typical defence |
|---|---|---|
| Confidentiality | Wi-Fi eavesdropping, leaked database | Encryption (TLS, WPA3), access control |
| Integrity | Tampered invoice PDF, altered DNS answer | Hashes, signatures, DNSSEC |
| Availability | DDoS floods, dead disk, cut cable | Redundancy, backups, rate limiting |
The triad is a sorting hat, not a ritual: when something bad happens, asking which promise broke? points you at the right fix instead of a random one.
Attacks on people: phishing and its cousins
Phishing is a message impersonating someone trustworthy to steal credentials or trigger an action. It is the number one initial access method in real breaches because it attacks the person, not the protocol.
- Phishing: mass email “from your bank” with a login link that is not your bank.
- Spear phishing: the same, but researched and personal: “invoice for the Nairobi order you discussed Tuesday.”
- Pretexting: a phone call “from IT” that needs your password to “fix your mailbox.”
The defence is procedural, not technical: verified channels for sensitive requests, MFA so a stolen password is not enough, and a culture where reporting a suspicious email is praised, not punished.
Attacks on the network: spoofing, MITM, DoS
Spoofing forges an identity: an IP, a MAC, a DNS answer. A man-in-the-middle attack relays traffic between two parties who believe they talk directly. Denial of service overwhelms a target until legitimate users cannot get through.
These map cleanly onto layers you already know: ARP spoofing poisons the MAC-to-IP mapping on a LAN so traffic detours through the attacker; rogue DHCP hands out a malicious gateway; DNS spoofing returns lying answers; a SYN flood abuses the TCP handshake until the listen queue is full. Encrypted protocols (HTTPS, SSH) do not stop interception. They make what is intercepted worthless, which is why the padlock matters even on a hostile network.
Defence in depth: assume one layer fails
No single control stops all attacks, so real networks stack them: segmentation limits where an intruder can move, encryption protects data in transit, MFA survives stolen passwords, monitoring notices what slipped through. Each layer exists because another one will eventually fail.
This is the thread running through the whole track: firewalls control who gets in, VPNs protect data crossing hostile networks, segmentation and Zero Trust limit the damage of a breach, and logging catches what everything else missed.
New track, same curriculum
This Security track builds directly on the fundamentals. If terms like MAC address, DHCP or the TCP handshake are still fuzzy, take the Fundamentals path first: every attack here abuses a mechanism taught earlier in the curriculum.
Frequently asked questions
What is the CIA triad in networking?
Confidentiality, integrity, availability: the three promises security keeps. Every control you deploy protects at least one of them.
What is the most common way networks actually get breached?
Phishing and stolen credentials, by a wide margin: attacking a person is cheaper than attacking a protocol. That is why MFA and a healthy reporting culture beat most hardware upgrades.
Does HTTPS stop man-in-the-middle attacks?
It makes them useless rather than impossible: an attacker can sit in the path, but TLS means they cannot read or silently alter traffic without triggering certificate warnings, which is why those warnings must never be clicked through.