1 Introduction to Information Security

What are we protecting, from whom, and how would we even know if we’d succeeded?

This first chapter sets up the ideas the rest of the book builds on. There is nothing to install yet. Just read it, and hold on to the questions at the end. They are worth returning to as the later chapters give you more to answer them with.

1.1 What this chapter covers

By the end you should be able to:

Define information security and explain the CIA triad: confidentiality, integrity, availability.
Explain why those three pull against each other, and what “balancing CIA” means in practice.
Say what a security control is, and what defence in depth buys you.
Walk through the phases of an attack, and explain why a defender studies them.
Distinguish ethical security work from malicious hacking, and see where the line sits.

1.2 Security is a property, not a product

You cannot buy security in a box. There is no single product, no switch, no certificate that makes a system “secure.” Security is not a thing a system has. It is a property of how the whole system behaves, including the people using it. A bank vault with the door propped open is not secure no matter how thick the steel. A perfectly configured server whose administrator uses “password1” is not secure either. Security is the emergent result of many choices, and it holds only as long as the weakest of them holds.

That is why this book keeps returning to a defender’s habit of mind rather than a checklist. Checklists go stale. The habit of asking “what am I protecting, from whom, and how would I know if it failed?” does not.

1.3 The CIA triad

Almost everything in information security can be traced back to protecting one of three properties of information. Together they are called the CIA triad (no relation to the agency).

Confidentiality is keeping information from those who should not see it. When you think of “security,” this is usually what comes to mind: secrets stay secret. Encryption, access controls, and passwords are all, at heart, confidentiality mechanisms. A confidentiality failure is a leak: data ending up in the wrong hands.

Integrity is keeping information correct and un-tampered. It is less obvious than confidentiality but often matters more. If an attacker cannot read your bank balance but can change it, you have a worse problem than a leak. Integrity mechanisms let you detect or prevent unauthorised change. A hospital needs to trust that a patient’s recorded blood type is the one a doctor entered, not one an attacker altered.

Availability is keeping information and systems there when they are needed. A system nobody can reach is no more useful than one that was deleted. Availability is the property attacked by a denial-of-service, threatened by a single point of failure, and protected by backups, redundancy, and capacity planning. It is the property people forget until the day the system is down and the business stops.

1.3.1 Balancing CIA

Here is the part that separates a defender from a checklist-follower: the three properties work against each other. You cannot turn all three up to maximum.

Maximise confidentiality (encrypt everything, demand three approvals for every access) and you damage availability, because legitimate users now wait, forget keys, and get locked out. Maximise availability (copy the data everywhere, let anyone read it instantly) and you have made confidentiality much harder. Lock a system down so hard that no change is ever allowed, and you have protected integrity at the cost of a system too rigid to use.

Real security is about the right balance for this information, this organisation, this risk. The balance a hospital strikes for patient records is not the one a newspaper strikes for tomorrow’s front page, and both are defensible. Learning to reason about that trade-off, rather than reaching for maximum everything, is the first real skill of the subject.

A fourth idea often sits alongside the triad: non-repudiation, the property that someone cannot credibly deny having done something. When a system can prove who made a change and when, disputes end and accountability begins. It is what turns “someone transferred the money” into “this account, at this time, authorised the transfer.”

1.4 Controls and defence in depth

A security control is anything you put between an asset and a threat to reduce risk: a password, a firewall, a locked door, a policy, a training session, a backup. Controls come in familiar flavours: some prevent (a lock stops entry), some detect (an alarm notices it), and some correct (a backup restores what was lost). A good defence uses all three, because prevention eventually fails.

This is the idea the book is named for. Defence in depth means never trusting a single control to be enough. You assume each layer will fail, and you put another behind it. A castle did not rely on the outer wall alone. It had a moat, then a wall, then a gate, then an inner keep, so that breaching one defence still left the attacker facing the next. A modern system is the same: a firewall and patched software and least-privilege accounts and monitoring and backups. No one layer is trusted, so no one failure is fatal.

This is the practical face of assume breach. If you assume the attacker will get past your first control, you stop asking “is this wall strong enough?” and start asking “when this fails, what catches it?” That question builds better systems than the search for one perfect wall ever could.

1.5 The phases of an attack

To defend against attackers, you have to understand how they work. You are not learning this to imitate them. You study each step to see what it needs, so you can take that away. Most intrusions move through recognisable phases:

Reconnaissance. The attacker gathers information about the target from the outside: who works there, what systems they run, what’s exposed. Quiet, often legal, and easy to overlook.
Scanning. They probe the target directly for live systems, open ports, and running services, mapping the attack surface. (This is what you’ll do, from the defender’s side, in an early lab.)
Gaining access. They exploit a weakness (a flaw, a weak password, a tricked user) to get a foothold.
Maintaining access. They entrench, so a reboot or a changed password doesn’t lock them out.
Clearing tracks. They cover their trail, deleting logs and hiding activity to delay discovery.

Read that list as a defender and each phase becomes an opportunity. Reconnaissance can be made harder by exposing less. Scanning can be detected. Access can be denied with patching and strong authentication. Persistence and track-clearing can be spotted by monitoring that the attacker cannot fully erase. Understanding the attacker’s process is where a defender’s leverage comes from.

1.6 Ethical hacking, and the line

Much of what you’ll learn in this book is, in mechanism, identical to what an attacker does: scanning systems, cracking passwords, capturing traffic. The difference is permission and purpose. An ethical practitioner acts with the owner’s authorisation, within an agreed scope, to find and fix weaknesses before a real attacker exploits them. The same action, without permission, is an offence.

This is where the old “hats” come from. A white hat works with authorisation, to find and fix. A black hat breaks in for their own gain or to cause harm. A grey hat acts without permission while believing the intent is good. Good intentions do not move the line. What separates the three is authorisation.

That line is sharp and it matters. Practise only in an environment you own or are explicitly authorised to use. The skills are dual-use. Your professionalism is what makes them defensive.

Try it yourself

If you want to practise as you read, set up a safe, isolated environment now: a disposable virtual machine or a set of containers, kept off your main network, so later chapters’ exercises have somewhere to run. Never practise on systems you do not own or have explicit permission to test. The practice-environment appendix lists some options.

1.7 Where this connects

The CIA triad and defence in depth are the lenses for the whole book. Almost every later control exists to protect one leg of the triad or to add one more layer. The next chapter begins the technical detail, looking at where software goes wrong and the malware that walks through the gaps.

1.8 Questions to consider

Give a real situation where confidentiality matters most, one where integrity matters most, and one where availability matters most. Use three different examples.
“More security is always better.” Describe one case where tightening security actually made things worse. What was traded away?
Why would a defender bother learning the phases of an attack? What specifically do you gain by understanding how an attacker thinks?