--- title: "F1: Security Basics" canonical: https://openvapt.com/academy/f1.html html: https://openvapt.com/academy/f1.html site: OpenVAPT, https://openvapt.com/ license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html modified: 2026-10-16 version: 0.1.0-alpha.6 --- # F1: Security Basics The core ideas every later lesson builds on: what we protect, what threatens it, and how risk is reasoned about. - Level: Foundations - Time: about 15 minutes ## You Will Be Able To - Explain confidentiality, integrity and availability with server examples. - Distinguish an asset, a threat, a vulnerability and a risk. - Apply least privilege and defence in depth to a Linux web server. ## The CIA Triad Security protects three properties of information. Confidentiality means only authorised people can read it. Integrity means it cannot be changed without authorisation, or changes are detected. Availability means it is there when legitimate users need it. On a web server, a leaked .env file breaks confidentiality. A defaced home page breaks integrity. A flood of half-open connections that stops the site breaks availability. CVSS scores later in this course measure impact on exactly these three properties. ## Assets, Threats, Vulnerabilities and Risk An asset is anything of value: data, a service, a reputation. A threat is something that could cause harm, such as an attacker guessing passwords. A vulnerability is a weakness a threat can use, such as SSH accepting passwords for root. Risk combines how likely the harm is with how bad it would be. A vulnerability assessment finds and rates vulnerabilities. It does not by itself measure risk to your organisation, because likelihood and impact depend on your environment. That is why every OpenVAPT report states this limitation. ## Least Privilege and Defence in Depth Least privilege means every account, process and service gets only the access it needs. Defence in depth means layering protections so one failure is not fatal: a firewall, then a service bound to 127.0.0.1, then authentication, then logging. Most OpenVAPT checks test one layer. Reading a report as a set of layers, not isolated items, is the habit of a good assessor. ## In Summary Security protects the confidentiality, integrity and availability of assets. Risk appears when a threat meets a vulnerability. Least privilege, defence in depth and a small attack surface reduce it. ## Apply It - [HOST-USR-003 Sudo Rules Without Password (NOPASSWD)](https://openvapt.com/checks/HOST-USR-003.md) (high) - [NET-DB-001 Database or Cache Service Exposed to the Network](https://openvapt.com/checks/NET-DB-001.md) (high) - [NET-FW-001 No Active Host Firewall](https://openvapt.com/checks/NET-FW-001.md) (medium) ## Lab 1. `Run: openvapt demo --lab vulnerable --out f1` 2. `Open f1/report.html. For three findings, write which CIA property each one threatens.` 3. `For NET-DB-001, list the layers that should have stopped the database being reachable.` ## Check Yourself Answer keys are public for every channel (see Teaching With OpenVAPT). 1. A backup file containing customer records is downloadable from the website. Which property is mainly affected? - A. Availability - B. Confidentiality - C. Integrity - D. None, because it is only a backup - Answer: B. Anyone can read data they are not authorised to read, so confidentiality is broken. A backup holds the same real data as the live system. 2. Which statement best describes a vulnerability? - A. A person who attacks systems - B. A weakness that a threat can use - C. The money lost in an incident - D. The chance that an incident happens - Answer: B. A vulnerability is the weakness. The attacker is the threat, the loss is the impact, and likelihood combined with impact is risk. 3. Binding MySQL to 127.0.0.1 even though a firewall exists is an example of: - A. Defence in depth - B. Security through obscurity - C. Availability testing - D. Risk acceptance - Answer: A. A second, independent layer protects the service if the firewall fails. Layering protections so one failure is not fatal is defence in depth. 4. A flood of half-open connections stops a web site answering real users. Which property is affected? - A. Confidentiality - B. Integrity - C. Availability - D. Authorisation - Answer: C. Nothing is read or changed, but legitimate users cannot reach the service. That is a loss of availability. 5. Why does a vulnerability assessment not, by itself, measure risk to your organisation? - A. Because scanners cannot find vulnerabilities - B. Because likelihood and impact depend on your environment - C. Because risk only applies to networks, not servers - D. Because the CVSS base score already includes your business impact - Answer: B. Risk combines likelihood and impact. Both depend on your environment, which a tool cannot see. The CVSS base score describes the vulnerability in general, not your business. 6. A web application's account can read every database on the server, but it needs only one. Which principle is broken? - A. Defence in depth - B. Least privilege - C. Availability - D. Security through obscurity - Answer: B. Least privilege means every account gets only the access it needs. Access to the other databases is extra harm waiting for a compromise. ## Key Terms - CIA Triad: Confidentiality, integrity and availability: the three properties information security protects. - Asset: Anything of value that needs protection, such as data, a service, a system or a reputation. - Threat: Anything that could cause harm to an asset, such as an attacker or a failure. - Vulnerability: A weakness that a threat could use to cause harm. - Risk: The combination of how likely harm is and how serious it would be. - Least Privilege: Giving every account and process only the access it needs, nothing more. - Defence in Depth: Using several independent layers of protection so that one failure does not lead to compromise. - Attack Surface: All the points where an attacker could try to interact with a system, such as listening ports, web pages and accounts. ## References - [NIST SP 800-12 Rev. 1, An Introduction to Information Security](https://csrc.nist.gov/pubs/sp/800/12/r1/final) - [NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments](https://csrc.nist.gov/pubs/sp/800/30/r1/final) Offline: `openvapt learn F1`. --- OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/f1.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.