Security Goals and Attack Surfaces

You’ll be able to

Explain confidentiality, integrity, availability, and attack surfaces
Apply the idea to evidence from a realistic technology scenario
Justify a decision using security, reliability, cost, and user impact

Security Goals and Attack Surfaces

The CIA triad names three security goals: confidentiality limits disclosure, integrity prevents unauthorized change, and availability keeps systems usable. An attack surface is every reachable path—accounts, devices, software, vendors, and people—through which one of those goals could be harmed.

Decision lens

Strong technical decisions connect evidence → mechanism → impact → response. Identify what the evidence shows, explain the system behavior that produced it, state the likely effect on people or data, and choose a response that addresses the cause without creating unnecessary disruption.

Worked example

A school scheduling service is online, but an attacker changes room assignments and publishes student accommodation notes.

1.Availability is intact because the service still loads.
2.Changed assignments violate integrity.
3.Exposed accommodation notes violate confidentiality.
4.Audit logs, access control, and tested backups address different parts of the incident.

Answer: The incident affects integrity and confidentiality; restoring a backup alone would not explain the disclosure or stop the attacker.

Checkpoint

Which event is primarily an availability failure?

Checkpoint

Which response best demonstrates complete reasoning about confidentiality, integrity, availability, and attack surfaces?

On the exam

For a scenario about confidentiality, integrity, availability, and attack surfaces, identify the decisive evidence before naming a response. A defensible conclusion here is: The incident affects integrity and confidentiality; restoring a backup alone would not explain the disclosure or stop the attacker.

Answer the 2 checkpoints as you read.