Think in security risks
Use the CIA triad to rank risks, and distinguish hacker labels from security team roles.
- Classify harm as a loss of confidentiality, integrity or availability
- Describe how a threat exploits a vulnerability to affect an asset
- Score and rank risks, and judge whether a control is worth its cost
- Distinguish black, white and gray hats from red, blue and purple team roles
Security people start with one question: what could go wrong, and how bad would it be? Everything else - firewalls, passwords, encryption - is an answer to that question.
Most harm fits one of three properties, the CIA triad:
- Confidentiality - only the right people can read information (a leaked customer list breaks it).
- Integrity - information and systems are correct and only changed by the right people (a tampered bank transfer breaks it).
- Availability - systems work when needed (a site knocked offline, or files encrypted by ransomware, breaks it).
Photo: PiDatacenters, CC BY-SA 4.0, adapted
Try it
Up to 15 XPWhich property was broken?
Sort each incident by the property it mainly harms. Some incidents hurt more than one - choose the main one.
“A misconfigured storage bucket lets anyone download patient records”
“An attacker changes the bank account number on a supplier’s invoices”
“A flood of traffic takes the online store offline on its busiest day”
“A student edits their grade in the school database”
“Ransomware encrypts every file on the office file server”
“An employee forwards the salary spreadsheet to their personal email”
Assets, threats, vulnerabilities, risk
- An asset is something valuable: customer records, a payment service, your reputation.
- A threat is something that could cause harm: a criminal group, a careless insider, a flood.
- A vulnerability is a weakness a threat can use: an unpatched server, a reused password, no backups.
- Risk combines how likely harm is with how much impact it would have.
A control reduces likelihood (patching, MFA), impact (backups, encryption) or both. Since you can’t fix everything at once, you score risks and work from the top. Frameworks such as the NIST Cybersecurity Framework 2.0 organize this work into six functions: Govern, Identify, Protect, Detect, Respond, Recover.
Equifax: a known flaw, a massive breach
The FTC says attackers used an unpatched Apache Struts vulnerability in Equifax’s public-facing dispute portal. The breach affected about 147 million people.
- 01A March alert called for a Struts patch within 48 hours.
- 02The vulnerable portal stayed unpatched; a misconfigured scan missed it.
- 03Attackers entered the portal and reached sensitive data elsewhere.
- 04Personal information for roughly 147 million people was exposed.
Who finds or exploits the weakness?
Hacker describes a person using technical skills; it does not, by itself, tell you whether they have permission. The “hat” colors are informal shorthand for conduct, not certifications or job titles:
| Label | Typical conduct |
|---|---|
| White hat / ethical hacker | Tests with the owner’s permission, stays within an agreed scope, and reports findings so they can be fixed. |
| Black hat | Breaks in without permission to steal, extort, disrupt, or otherwise cause harm. |
| Gray hat | May intend to report a flaw, but tests a system without permission or goes beyond the allowed scope. Good intentions do not grant access. |
For an authorized test, rules of engagement define targets, allowed methods, timing, contacts, and stop conditions before testing begins. The NIST discussion of white and black hats describes the skill overlap; permission and conduct make the practical difference.
Try it
Up to 15 XPWhich hat fits the situation?
Classify each scenario by the person’s conduct. The same technical skill can be used in very different ways.
“A researcher tests only the endpoints listed in a signed engagement and privately reports a flaw”
“Someone steals customer records from a company and demands payment”
“A curious person probes a stranger’s server without permission, finds a flaw, and emails the owner”
“A tester ignores an agreed exclusion and scans a third-party system to be helpful”
Red, blue and purple are team roles
A team color describes a role in a security exercise or operation; it is not another kind of hat. A white-hat professional might work on a red team, and a red team is not a group of real criminals.
| Team | What it does | Example |
|---|---|---|
| Red team | With authorization, imitates an adversary to test defenses and show the impact of a successful attack. | Tries to reach a mock sensitive file during an agreed exercise. |
| Blue team | Defends systems: hardens them, monitors alerts, investigates, contains, and recovers. | Notices suspicious sign-ins and blocks the test path. |
| Purple team | Brings red and blue together to replay an attack technique, compare observations, and improve detection and prevention. It may be a collaboration rather than a separate permanent team. | Repeats the sign-in test after the alert rule is improved. |
| White team | In some exercises, sets and enforces rules, observes the exercise, and keeps it safe and fair. This is different from “white hat.” | Stops a test that reaches an excluded system. |
NIST defines red and blue team roles and the white team’s exercise role. MITRE describes purple teaming as a way for offensive and defensive teams to work together.
Try it
Up to 15 XPWho does what in an exercise?
Match each action to its team role. All testing here is authorized and follows the exercise rules.
“Simulates an attacker trying to reach a mock customer database”
“Investigates an unusual login alert and isolates the affected test machine”
“Replays the same technique with defenders to check whether a new detection works”
“Defines the exercise boundary and stops a test that could affect production”
Practice: spend a security budget
Try it
Up to 15 XPGet every risk out of the red
You have $60k and can’t buy everything. Each control moves risks on the matrix, where likelihood × impact of 15 or more is high. Some sound impressive but won’t get you there.
- Phishing: 5 × 4 = 20 High
- Ransomware: 3 × 5 = 15 High
- Laptop theft: 3 × 3 = 9 Medium
- Flood: 1 × 5 = 5 Low
Practice: is the control worth it?
Try it
Up to 15 XPPut a number on a risk
SLE is what one incident costs (asset value × share lost). ALE is what it costs per year (SLE × incidents per year). A control is worth it if it saves more than it costs.
Key takeaways
Confidentiality, integrity and availability describe what kind of harm you’re preventing.
A threat exploits a vulnerability to harm an asset; risk weighs likelihood and impact.
Score risks to prioritize, and revisit them as systems and threats change.
Hats describe conduct; red, blue, purple and white teams describe roles in a security exercise.
Lesson quiz
10 questions · pass with 7 correct · up to 50 XP
Passing this quiz completes the lesson and keeps your streak going. Questions you miss come back in review sessions later.
Questions about this lesson
Stuck? Ask. Figured something out? Share it. Explaining is one of the best ways to learn.
Loading posts…