Cybersecurity midterm study guide: CIA triad and security fundamentals - Claude 2026-06-12, 1:18 PM
CITM820 / Cybersecurity midterm study guide: CIA triad and security fundamentals !
Module 1- Chapter 1:
I am studying for a cybersecurity midterm. I will paste my textbook chapter
after this prompt.
Your task is to teach me Module 1 in a way that allows me to:
Understand concepts deeply
Recognize them even when questions are worded differently
Answer difficult multiple-choice questions
Retain the information long-term
Topics:
Show more
Orchestrated comprehensive cybersecurity teaching package with tight, structured delivery
Module 1 — Chapter 1: Overview (Stallings & Brown, 5th ed.)
1. Chapter Summary
Computer security = measures that protect the confidentiality, integrity, and availability
(CIA) of a system's hardware, software, firmware, data, and communications. Two extra
goals are sometimes added: authenticity and accountability.
The chapter then builds a chain of related ideas: assets have vulnerabilities → threats can
exploit them → an exploited threat is an attack → carried out by a threat agent → causing a
threat consequence (loss of C, I, or A). To reduce harm you apply countermeasures
(prevent, detect, recover) — but these may introduce new flaws, leaving residual
vulnerabilities and a residual level of risk.
It classifies attacks (passive vs active, inside vs outside), lists threat consequences (RFC
4949), states 17 functional requirement areas (FIPS 200), the 13 fundamental design
principles (first 8 from Saltzer & Schroeder 1975), tools for evaluating threats (attack
surfaces, attack trees), and a 3-part security strategy: policy (what), implementation
(how), assurance/evaluation (does it work).
2 & 3. Concepts — Simple First, Then Exam-Level
https://claude.ai/chat/4ed0edc4-9010-451d-9fc9-83d51a75c6d9 Page 1 of 48
,Cybersecurity midterm study guide: CIA triad and security fundamentals - Claude 2026-06-12, 1:18 PM
2 & 3. Concepts — Simple First, Then Exam-Level
Confidentiality — Simple: keeping secrets secret. Exam: preserving authorized
restrictions on access and disclosure (covers data confidentiality + privacy). Loss =
unauthorized disclosure.
Integrity — Simple: data/system isn't tampered with. Exam: guarding against improper
modification/destruction (covers data integrity + system integrity). Loss = unauthorized
modification or destruction. FIPS 199 folds authenticity under integrity.
Availability — Simple: the system works when you need it. Exam: ensuring timely, reliable
access/use. Loss = disruption of access.
Authenticity — being genuine and verifiable; you are who you claim, input came from a
trusted source.
Accountability — actions trace uniquely to an entity; supports nonrepudiation, forensics,
deterrence. (Note: truly secure systems aren't achievable, so we must be able to trace
breaches — that's why accountability exists.)
Vulnerability / Threat / Attack / Risk — vulnerability = weakness; threat = potential harm;
attack = a threat carried out; risk = probability a threat exploits a vulnerability × harm.
Three vulnerability types map to CIA: corrupted (→integrity), leaky (→confidentiality),
unavailable/slow (→availability).
Passive attack — learns/uses info, does not alter resources. Hard to detect, so emphasis is
prevention (encryption). Two types: release of message contents, traffic analysis.
Active attack — alters resources or operation. Hard to prevent, so emphasis is detection +
recovery. Four types: replay, masquerade, modification of messages, denial of service
(DoS).
Inside vs outside attack — inside = authorized insider misusing access; outside =
unauthorized external party.
Residual vulnerabilities — a countermeasure may itself add flaws; whatever weakness
remains after countermeasures leaves a residual risk the owner tries to minimize.
Attack surface — the reachable + exploitable vulnerabilities. Three kinds: network,
software, human. Shrinking it = harder for attacker.
Attack tree — hierarchical tree: root = attacker's goal, branches/sub-nodes = ways to
reach it, leaves = ways to initiate the attack. Used to document and analyze attacks.
Security policy — formal statement of rules/practices regulating how a system provides
https://claude.ai/chat/4ed0edc4-9010-451d-9fc9-83d51a75c6d9 Page 2 of 48
,Cybersecurity midterm study guide: CIA triad and security fundamentals - Claude 2026-06-12, 1:18 PM
Security policy — formal statement of rules/practices regulating how a system provides
security (RFC 4949). Built from: asset value, vulnerabilities, threats/likelihood. Trade-offs:
ease of use vs security, cost of security vs cost of failure/recovery. It's a business
decision.
Security implementation — the mechanisms; functionally: prevention, detection,
response, recovery.
Assurance vs evaluation — assurance = degree of confidence (not proof) that
design+implementation enforce the policy. Evaluation = the process of examining a
product against criteria (testing/analysis), enabling product comparison.
4. How Concepts Connect
Owners value Assets → assets have Vulnerabilities → Threat agents create Threats
→ carried out = Attacks → causing loss of C/I/A → owners impose Countermeasures
to reduce Risk → but countermeasures leave residual vulnerabilities → residual
risk.
The three viewpoints in §1.3–1.5 are three angles on the same countermeasure problem:
functional requirements (FIPS 200, what areas to cover), design principles (how to build
mechanisms well), attack surfaces/trees (how to find/classify what to defend). The §1.6
strategy ties it together: policy = specification, implementation = mechanism, assurance
= correctness.
5. Common Misconceptions (exam landmines)
"Integrity = confidentiality." No — integrity is about modification, confidentiality
about disclosure.
"Authenticity and accountability are part of the CIA triad." No — they're additional
goals. FIPS 199 puts authenticity under integrity, but the triad is only C, I, A.
"Passive attacks are detected; active attacks are prevented." Backwards. Passive →
prevent (hard to detect); active → detect/recover (hard to prevent).
"Replay is a passive attack." No — replay is an active attack (it retransmits to produce
an effect). The capture is passive; the replay makes it active.
"Traffic analysis is active." No — passive.
"Risk = threat." No — risk is a probability × impact.
"Open design = keep the algorithm secret." Backwards — algorithm public, keys
https://claude.ai/chat/4ed0edc4-9010-451d-9fc9-83d51a75c6d9 Page 3 of 48
, Cybersecurity midterm study guide: CIA triad and security fundamentals - Claude 2026-06-12, 1:18 PM
"Open design = keep the algorithm secret." Backwards — algorithm public, keys
secret (Kerckhoffs).
"Fail-safe defaults = deny by default." Correct phrasing: access based on permission,
not exclusion; default = no access.
"Assurance proves the system is correct." No — assurance is a degree of confidence,
not a proof.
"DoS attacks confidentiality." No — DoS attacks availability.
6. Comparison Tables
Passive vs Active
Passive Active
Alters No Yes
resources?
Goal Learn/use info Alter/disrupt
Types Release of message contents, traffic Replay, masquerade, modification,
analysis DoS
Detect? Very hard Easier
Prevent? Feasible (encryption) Very hard
Emphasis Prevention Detection + recovery
Threat Consequences → Threat Actions (RFC 4949, Table 1.2) — high-yield
Consequence Affects Threat actions (attacks)
Unauthorized Disclosure Confidentiality Exposure, Interception, Inference, Intrusion
Deception Integrity (data/system) Masquerade, Falsification, Repudiation
Disruption Availability / system integrity Incapacitation, Corruption, Obstruction
Usurpation (control) Misappropriation, Misuse
https://claude.ai/chat/4ed0edc4-9010-451d-9fc9-83d51a75c6d9 Page 4 of 48
CITM820 / Cybersecurity midterm study guide: CIA triad and security fundamentals !
Module 1- Chapter 1:
I am studying for a cybersecurity midterm. I will paste my textbook chapter
after this prompt.
Your task is to teach me Module 1 in a way that allows me to:
Understand concepts deeply
Recognize them even when questions are worded differently
Answer difficult multiple-choice questions
Retain the information long-term
Topics:
Show more
Orchestrated comprehensive cybersecurity teaching package with tight, structured delivery
Module 1 — Chapter 1: Overview (Stallings & Brown, 5th ed.)
1. Chapter Summary
Computer security = measures that protect the confidentiality, integrity, and availability
(CIA) of a system's hardware, software, firmware, data, and communications. Two extra
goals are sometimes added: authenticity and accountability.
The chapter then builds a chain of related ideas: assets have vulnerabilities → threats can
exploit them → an exploited threat is an attack → carried out by a threat agent → causing a
threat consequence (loss of C, I, or A). To reduce harm you apply countermeasures
(prevent, detect, recover) — but these may introduce new flaws, leaving residual
vulnerabilities and a residual level of risk.
It classifies attacks (passive vs active, inside vs outside), lists threat consequences (RFC
4949), states 17 functional requirement areas (FIPS 200), the 13 fundamental design
principles (first 8 from Saltzer & Schroeder 1975), tools for evaluating threats (attack
surfaces, attack trees), and a 3-part security strategy: policy (what), implementation
(how), assurance/evaluation (does it work).
2 & 3. Concepts — Simple First, Then Exam-Level
https://claude.ai/chat/4ed0edc4-9010-451d-9fc9-83d51a75c6d9 Page 1 of 48
,Cybersecurity midterm study guide: CIA triad and security fundamentals - Claude 2026-06-12, 1:18 PM
2 & 3. Concepts — Simple First, Then Exam-Level
Confidentiality — Simple: keeping secrets secret. Exam: preserving authorized
restrictions on access and disclosure (covers data confidentiality + privacy). Loss =
unauthorized disclosure.
Integrity — Simple: data/system isn't tampered with. Exam: guarding against improper
modification/destruction (covers data integrity + system integrity). Loss = unauthorized
modification or destruction. FIPS 199 folds authenticity under integrity.
Availability — Simple: the system works when you need it. Exam: ensuring timely, reliable
access/use. Loss = disruption of access.
Authenticity — being genuine and verifiable; you are who you claim, input came from a
trusted source.
Accountability — actions trace uniquely to an entity; supports nonrepudiation, forensics,
deterrence. (Note: truly secure systems aren't achievable, so we must be able to trace
breaches — that's why accountability exists.)
Vulnerability / Threat / Attack / Risk — vulnerability = weakness; threat = potential harm;
attack = a threat carried out; risk = probability a threat exploits a vulnerability × harm.
Three vulnerability types map to CIA: corrupted (→integrity), leaky (→confidentiality),
unavailable/slow (→availability).
Passive attack — learns/uses info, does not alter resources. Hard to detect, so emphasis is
prevention (encryption). Two types: release of message contents, traffic analysis.
Active attack — alters resources or operation. Hard to prevent, so emphasis is detection +
recovery. Four types: replay, masquerade, modification of messages, denial of service
(DoS).
Inside vs outside attack — inside = authorized insider misusing access; outside =
unauthorized external party.
Residual vulnerabilities — a countermeasure may itself add flaws; whatever weakness
remains after countermeasures leaves a residual risk the owner tries to minimize.
Attack surface — the reachable + exploitable vulnerabilities. Three kinds: network,
software, human. Shrinking it = harder for attacker.
Attack tree — hierarchical tree: root = attacker's goal, branches/sub-nodes = ways to
reach it, leaves = ways to initiate the attack. Used to document and analyze attacks.
Security policy — formal statement of rules/practices regulating how a system provides
https://claude.ai/chat/4ed0edc4-9010-451d-9fc9-83d51a75c6d9 Page 2 of 48
,Cybersecurity midterm study guide: CIA triad and security fundamentals - Claude 2026-06-12, 1:18 PM
Security policy — formal statement of rules/practices regulating how a system provides
security (RFC 4949). Built from: asset value, vulnerabilities, threats/likelihood. Trade-offs:
ease of use vs security, cost of security vs cost of failure/recovery. It's a business
decision.
Security implementation — the mechanisms; functionally: prevention, detection,
response, recovery.
Assurance vs evaluation — assurance = degree of confidence (not proof) that
design+implementation enforce the policy. Evaluation = the process of examining a
product against criteria (testing/analysis), enabling product comparison.
4. How Concepts Connect
Owners value Assets → assets have Vulnerabilities → Threat agents create Threats
→ carried out = Attacks → causing loss of C/I/A → owners impose Countermeasures
to reduce Risk → but countermeasures leave residual vulnerabilities → residual
risk.
The three viewpoints in §1.3–1.5 are three angles on the same countermeasure problem:
functional requirements (FIPS 200, what areas to cover), design principles (how to build
mechanisms well), attack surfaces/trees (how to find/classify what to defend). The §1.6
strategy ties it together: policy = specification, implementation = mechanism, assurance
= correctness.
5. Common Misconceptions (exam landmines)
"Integrity = confidentiality." No — integrity is about modification, confidentiality
about disclosure.
"Authenticity and accountability are part of the CIA triad." No — they're additional
goals. FIPS 199 puts authenticity under integrity, but the triad is only C, I, A.
"Passive attacks are detected; active attacks are prevented." Backwards. Passive →
prevent (hard to detect); active → detect/recover (hard to prevent).
"Replay is a passive attack." No — replay is an active attack (it retransmits to produce
an effect). The capture is passive; the replay makes it active.
"Traffic analysis is active." No — passive.
"Risk = threat." No — risk is a probability × impact.
"Open design = keep the algorithm secret." Backwards — algorithm public, keys
https://claude.ai/chat/4ed0edc4-9010-451d-9fc9-83d51a75c6d9 Page 3 of 48
, Cybersecurity midterm study guide: CIA triad and security fundamentals - Claude 2026-06-12, 1:18 PM
"Open design = keep the algorithm secret." Backwards — algorithm public, keys
secret (Kerckhoffs).
"Fail-safe defaults = deny by default." Correct phrasing: access based on permission,
not exclusion; default = no access.
"Assurance proves the system is correct." No — assurance is a degree of confidence,
not a proof.
"DoS attacks confidentiality." No — DoS attacks availability.
6. Comparison Tables
Passive vs Active
Passive Active
Alters No Yes
resources?
Goal Learn/use info Alter/disrupt
Types Release of message contents, traffic Replay, masquerade, modification,
analysis DoS
Detect? Very hard Easier
Prevent? Feasible (encryption) Very hard
Emphasis Prevention Detection + recovery
Threat Consequences → Threat Actions (RFC 4949, Table 1.2) — high-yield
Consequence Affects Threat actions (attacks)
Unauthorized Disclosure Confidentiality Exposure, Interception, Inference, Intrusion
Deception Integrity (data/system) Masquerade, Falsification, Repudiation
Disruption Availability / system integrity Incapacitation, Corruption, Obstruction
Usurpation (control) Misappropriation, Misuse
https://claude.ai/chat/4ed0edc4-9010-451d-9fc9-83d51a75c6d9 Page 4 of 48
