Security Basics

The CIA Triad

Security protects three properties of information. Confidentiality means only authorised people can read it. Integrity means it cannot be changed without authorisation, or changes are detected. Availability means it is there when legitimate users need it.

On a web server, a leaked .env file breaks confidentiality. A defaced home page breaks integrity. A flood of half-open connections that stops the site breaks availability. CVSS scores later in this course measure impact on exactly these three properties.

Assets, Threats, Vulnerabilities and Risk

An asset is anything of value: data, a service, a reputation. A threat is something that could cause harm, such as an attacker guessing passwords. A vulnerability is a weakness a threat can use, such as SSH accepting passwords for root. Risk combines how likely the harm is with how bad it would be.

A vulnerability assessment finds and rates vulnerabilities. It does not by itself measure risk to your organisation, because likelihood and impact depend on your environment. That is why every OpenVAPT report states this limitation.

Least Privilege and Defence in Depth

Least privilege means every account, process and service gets only the access it needs. Defence in depth means layering protections so one failure is not fatal: a firewall, then a service bound to 127.0.0.1, then authentication, then logging.

Most OpenVAPT checks test one layer. Reading a report as a set of layers, not isolated items, is the habit of a good assessor.

In Summary

Security protects the confidentiality, integrity and availability of assets. Risk appears when a threat meets a vulnerability. Least privilege, defence in depth and a small attack surface reduce it.

Apply It

These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.

Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Lab

1. Run: openvapt demo --lab vulnerable --out f1
2. Open f1/report.html. For three findings, write which CIA property each one threatens.
3. For NET-DB-001, list the layers that should have stopped the database being reachable.

Check Yourself

Answers are checked in your browser and never stored or sent.

References

• NIST SP 800-12 Rev. 1, An Introduction to Information Security
• NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.

OpenVAPT. (2026). F1: Security Basics (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/f1.html

@misc{openvapt_f1,
  author       = {{OpenVAPT}},
  title        = {{F1: Security Basics}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/academy/f1.html}},
  note         = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}