Security Principles and Threat Actors
Apply the CIA triad, risk language, and attacker models to judge real controls and real threats.
- Certification
- CompTIA Security+
- Recommended study time
- 5h 30m
- Status
- Not started
Recommended study time
About 5h 30m in total, measured from the material on this page. At your session length of 45 minutes that is 8 sittings.
- Read the lesson20 min
About 2,587 words at a careful technical reading pace.
- Second pass with notes12 min
Re-read the harder parts and write your own notes.
- Recall from memory12 min
2 written recall questions.
- Practice decision12 min
One applied decision with feedback.
- Teach it back20 min
Write the topic in your own words.
- Real-world scenario15 min
Read the situation and justify your decision in writing.
- Hands-on practice2h 40m
Labs, commands and configuration until you can do it unaided.
- Spaced review1h 20m
4 short review sessions spread over the following weeks.
Learning objectives
- Use confidentiality, integrity, and availability to classify controls and impacts.
- Distinguish threat, vulnerability, risk, and impact precisely.
- Characterise threat actors by motivation, capability, and typical technique.
Start here
About 8 minutes of reading, in 10 short parts.
Security work starts with a small set of core principles that every control, policy, and decision traces back to. Once you know these principles and the common categories of threats and attackers, most security news and workplace policies stop feeling arbitrary and start making obvious sense.
Where you meet it: A security analyst reviewing an incident has to decide whether it threatens confidentiality, integrity, or availability, because that decision shapes who gets notified and how urgently.
The lesson, part by part
Open one part at a time. Each part stands on its own, so you can stop and come back.
Imagine your house: you want your private letters kept secret (confidentiality), you want nobody to be able to sneak in and change your letters without you noticing (integrity), and you want to actually be able to get into your own house whenever you need to (availability). Almost every security decision is a balance between these three goals, often called the CIA triad.
Threats to that house come in different shapes: a burglar who wants your valuables (a criminal attacker), a nosy neighbour who reads your mail out of curiosity (an insider threat), a professional thief hired to steal a specific item (a targeted attacker), and a storm that knocks your door down by accident (a non-malicious hazard). Security work means understanding which of these you are actually defending against, because the defences look different for each.
Key ideas
If you remember nothing else from this topic, remember these.
- The CIA triad (confidentiality, integrity, availability) frames nearly every security control as protecting one or more of these three properties.
- Threat actors range from opportunistic script kiddies to well-resourced nation-state advanced persistent threats, and their motivation and sophistication shape the appropriate defence.
- Social engineering exploits human trust rather than technical flaws, making phishing, pretexting, and baiting effective even against well-patched systems.
- Malware categories, such as ransomware, worms, trojans, and rootkits, differ in how they spread and what damage they cause, which affects both detection and response.
- The AAA framework, authentication, authorization, and accounting, describes proving identity, granting appropriate access, and logging what was done.
- Defence in depth layers multiple independent controls so that the failure of any single control does not lead directly to compromise.
Tracing a phishing-triggered ransomware incident to its root cause
A worked example, step by step.
A finance department employee clicks a link in an email, and within hours several shared drive files are found encrypted with a ransom note.
- 01Confirm the initial vectorReview the employee's email and find a spoofed invoice message with a malicious attachment, disguised as pretexting to appear like a routine vendor request.
- 02Classify the threat actorAssess the level of sophistication in the attack and conclude it resembles an opportunistic criminal campaign rather than a targeted nation-state operation.
- 03Identify the malware categoryDetermine the payload is ransomware, since it encrypted files and demanded payment rather than quietly exfiltrating data like a typical trojan.
- 04Assess the CIA triad impactNote that availability was harmed (files inaccessible), integrity is uncertain until files are verified, and confidentiality impact depends on whether data was also stolen before encryption.
- 05Contain the spreadIsolate the infected workstation from the network immediately to stop lateral movement to other shared drives.
- 06Review authentication and authorizationCheck whether the compromised account had unnecessarily broad access to shared drives, an authorization failure that widened the impact.
- 07Check accounting logsReview file access logs to determine exactly which files were touched and when, supporting both recovery and any required breach notification.
- 08Recommend improved layered defencePropose email filtering, security awareness training, endpoint detection, and least-privilege access as complementary layers so no single failure causes this scale of damage again.
Outcome: A single phishing click caused a cascading ransomware event because access was overly broad; the response combined containment, log review, and defence-in-depth recommendations to reduce recurrence.
Core security concepts and threat categories
Worth keeping at hand while you work.
- Confidentiality
- Preventing unauthorized disclosure of information
- Integrity
- Preventing unauthorized modification of information
- Availability
- Ensuring systems and data are accessible when needed
- Script kiddie
- Low-skill attacker using existing tools without deep understanding
- Hacktivist
- Attacker motivated by political or social causes
- APT (Advanced Persistent Threat)
- Highly resourced, often nation-state attacker seeking long-term access
- Phishing
- Fraudulent messages designed to trick victims into acting
- Pretexting
- Fabricating a false scenario to manipulate a target
- Ransomware
- Malware that encrypts data and demands payment for release
- Worm
- Self-replicating malware that spreads without user action
- Trojan
- Malware disguised as legitimate software
- Rootkit
- Malware designed to hide its presence and maintain privileged access
- Authentication
- Proving identity
- Authorization
- Granting appropriate access after identity is confirmed
- Accounting
- Logging what an authenticated user did
Common misunderstandings
What most beginners get wrong here.
Security is mainly about stopping outside hackers with strong firewalls.
A significant share of incidents start with social engineering or insider mistakes, meaning human-focused controls like training are just as critical as technical firewalls.
A worm and a virus are the same thing.
A worm self-replicates and spreads without requiring a host file or user action, while a traditional virus needs to attach to a file and typically requires user action to spread.
Confidentiality, integrity, and availability are ranked in importance with confidentiality always first.
The relative priority of the CIA triad depends on context; a hospital's patient monitoring system may prioritize availability above confidentiality.
Authentication and authorization mean the same thing.
Authentication proves who you are, while authorization determines what you are allowed to do once your identity is confirmed; they are distinct steps.
Advanced attackers always use sophisticated zero-day exploits.
Even advanced persistent threats frequently use simple phishing or known unpatched vulnerabilities because it is efficient, reserving expensive zero-days for high-value targets.
Exam traps
How the question writers try to catch you out.
- Security+ frequently asks you to classify a described scenario into a threat actor type, expecting recognition of motivation and sophistication clues.
- Expect a question distinguishing a worm from a virus based on whether user action or a host file is required to spread.
- CIA triad questions often present a scenario, such as a DDoS attack, and ask which triad component was primarily violated (availability).
- AAA questions test whether you can separate authentication, authorization, and accounting in a described access control scenario.
- Social engineering questions expect precise terminology matching, such as pretexting versus phishing versus baiting, based on the described technique.
Check yourself
Answer in your head first, then reveal. This is not scored.
What are the three components of the CIA triad?
How does a worm differ from a traditional virus?
What triad component is primarily violated by a denial-of-service attack?
What is the difference between authentication and authorization?
Why do even advanced persistent threats often use simple phishing?
What social engineering technique involves fabricating a false scenario to gain trust?
Quick reference
A condensed summary of the lesson above, for revision.
What It Is
Confidentiality, integrity, and availability define what security protects. A threat is an actor or event that could cause harm; a vulnerability is a weakness it could exploit; risk is the combination of likelihood and impact. Controls are preventive, detective, or corrective, and technical, administrative, or physical. Threat actors range from opportunistic criminals and insiders to organised crime and state-sponsored groups.
Why It Matters
Budgets are finite. Framing a proposal as 'this control reduces the likelihood of a high-impact ransomware event' wins support where 'hackers are dangerous' does not. This vocabulary is also the backbone of Security+ questions.
How It Works
- Assets are identified, threats and vulnerabilities are mapped, and risk is rated by likelihood and impact.
- Controls are selected to reduce, transfer, avoid, or accept the residual risk.
- Detection and response assume prevention will sometimes fail.
Where You See It
- Risk registers, security reviews, vendor assessments, incident post-mortems, and board reporting.
Key Terms
- Risk
- The combination of likelihood and impact for a given scenario.
- Control
- A safeguard reducing likelihood or impact.
- Defence in depth
- Layered controls so one failure is not fatal.
- Attack surface
- The set of exposed entry points an attacker can reach.
- Threat actor
- The party attempting to cause harm, with motive and capability.
Examples
- Backups do not prevent ransomware; they reduce impact and support recovery.
- MFA reduces the likelihood that a stolen password becomes an account compromise.
Common Problems
- Controls chosen without threat modelling
- Unmeasured residual risk
- Single points of failure
- Alert fatigue
How It Fails
- Spending on prevention alone leaves an organisation blind when prevention is bypassed.
- Undocumented risk acceptance surfaces only after an incident.
- Excessive alerting causes genuine detections to be ignored.
How to Troubleshoot
- Ask which CIA property was harmed to focus an investigation.
- Separate the vulnerability from the exploitation path when assessing urgency.
- Re-evaluate likelihood with real telemetry rather than intuition.
Practical Knowledge
- Document accepted risks with an owner and review date.
- Prefer controls that both reduce risk and produce evidence.
Exam Coverage
- CIA triad and control types
- Threat actors and motivations
- Risk terminology and management options
Interview Questions
- Explain the difference between a vulnerability and a risk.
- How would you justify MFA to a cost-focused manager?
Watch and read
Verified official and reputable sources for this topic. Links open in a new tab.
Video training
Lesson notes and bookmark
Notes and bookmarks for this lesson, saved with everything else you have marked.
No notes on this item yet.
Learning progress
0% across six evidence areas. Reading alone does not change progress.
Prerequisites
Next steps
- 01Write a one-paragraph risk statement for a system you know.
- 02Classify five controls in your environment as preventive, detective, or corrective.