Cybersecurity 101: From CIA Triad to Cybersecurity Framework, With a Spice of Modern Oversight

So recently, I have been diving a bit into Cybersecurity, and am interested to master it into detail. So in this article, and probably some upcoming ones, I will write regarding my findings, or some interesting reads :).

CIA Triad

Source of image https://www.igmguru.com/blog/what-is-the-cia-triad

Modern cybersecurity, when it comes to digital assets, relies on the CIA triad, one of the foundational models that talks about ensuring data confidentiality, integrity, and availability through strategic risk management. The Confidentiality part is basically that only people that are intended to know the information, have access to it. The Integrity part covers that data is not tempered with, like for example during the internet transfer, and Availability covers that the user needs to have access to his data, meaning that the system needs to be secured enough so that any random kind of attack does not shut down the availability like for example attacking and shutting down the server operation.

NIST and CSF

The National Institute of Standards and Technology (NIST) is a non-regulatory federal agency within the U.S. Department of Commerce, founded in 1901 to advance measurement science, standards, and technology. It promotes U.S. innovation and industrial competitiveness by creating frameworks for cybersecurity, AI, and physical sciences. NIST CSF (Cybersecurity Framework) is a voluntary, flexible, and outcome-driven framework from NIST, designed to help organizations of all sizes manage and reduce cybersecurity risk. It serves as a gold standard for security, providing a common language to identify, protect, detect, respond, and recover from cyber threats.

The 6 Core Functions of NIST CSF 2.0

Source of Image https://csf.tools/general/nist-releases-version-2-of-the-cybersecurity-framework-csf/

• Govern (The New Pillar as of 2024): This is the “Big Picture.” It’s about establishing the organization’s cybersecurity strategy, roles, and responsibilities. It ensures that security isn’t just an IT problem, but a leadership priority.
• Identify: Understanding your environment. You can’t protect what you don’t know you have. This involves cataloging assets (hardware, software), identifying risks, and knowing your legal requirements.
• Protect: Putting up the defenses. This aligns with your CIA Triad goals. It includes access control (AAA, more about this later), awareness training for staff, and data security (encryption).
• Detect: Finding the “bad guys.” This is the monitoring phase. If an anomaly occurs (like a sudden spike in data leaving the server), this function ensures the system flags it immediately.
• Respond: Taking action once a breach is detected. This involves communication, analysis, and mitigation — basically, stopping the attack from spreading.
• Recover: Getting back to normal. This involves restoring systems from backups and learning from the event to make the “Identify” and “Protect” phases stronger for next time.

The “AAA” Framework

If CIA is the goal, AAA is the process. It’s the gatekeeper of any system.

• Authentication: Proving you are who you say you are (passwords, biometrics).
• Authorization: Determining what you are allowed to do (permissions).
• Accounting: Keeping a log of what you did (audit trails).

Threat Actors & Social Engineering

Image source https://www.paubox.com/blog/what-is-social-engineering-and-why-healthcare-is-vulnerable

Security isn’t just about code; it’s about people. Here are some common threats:

• Social Engineering: Manipulating people into giving up secrets.
• Phishing: The most common “Internet Vice” you’ll see — fake emails or messages designed to steal credentials.
• Insider Threats: Sometimes the threat comes from a disgruntled employee or someone making an honest mistake, like letting another person in through the guarded door by mistakenly thinking he is also an employee.

Defense in Depth (The “Onion” Strategy)

Image URL: https://microage.ca/wp-content/uploads/2022/03/8.png

This is the concept that no single security measure is perfect. You need multiple layers so that if one fails, others are there to stop the intruder.

Layers include: Physical security (locks), Network security (firewalls), Endpoint security (antivirus), and Data security (encryption).

Example of Incident Response & Recovery

In modern cybersecurity, we assume a breach will happen eventually, so we follow these steps (Follows CSF standards):

• Identification: Detecting the attack.
• Containment: Stopping the “bleeding” (e.g., pulling a server off the network).
• Recovery: Getting systems back online using those backups we mentioned in Availability.

Cybersecurity in the Age of Artificial Intelligence (AI)

Iamge source https://www.ttec.com/blog/how-integrate-ai-your-cybersecurity-and-why-you-should

As traditional perimeter defenses become obsolete, the industry is transitioning toward Zero Trust Architecture, which adopts a “never trust, always verify” philosophy to secure distributed environments. This evolution is increasingly influenced by artificial intelligence, creating a complex arms race where machine learning enhances defensive automation while enabling more sophisticated, automated attacks. Beyond technical infrastructure, organizations must address systemic risks such as software supply chain vulnerabilities and the persistent impact of human error. To build long-term resilience, experts advocate for “Secure by Design” methodologies and the adoption of established governance frameworks like NIST and ISO standards. Ultimately, effective protection requires a holistic integration of advanced technology, rigorous policy, and continuous user education.

Here are things to look after during this era:

• Defending Against “Machine-Speed” Attacks: In the age of AI, attackers now use autonomous agents to scan for vulnerabilities and launch hyper-personalized phishing campaigns at a scale and speed that manual human defense can no longer match.
• The Rise of Deepfakes and Deception: Traditional “Identity” checks are under fire as AI-generated audio and video (deepfakes) make it easier for hackers to impersonate executives or bypass biometric security during social engineering attacks.
• Securing the AI Infrastructure: Cybersecurity now extends to protecting the AI models themselves from “prompt injection” or “data poisoning,” where attackers trick an AI into leaking sensitive corporate data or making biased, unsafe decisions.
• Fighting AI with AI: As mentioned -> modern defense requires a “Zero Trust” approach integrated with AI-driven monitoring that can detect subtle behavioral anomalies in real-time, effectively using automation to stop automated threats.

Acknowledgements

I used images from other articles, as a kudos to them, I’ve mostly provided their sources, so you can check their content, as the quick peek I did to them, they seem to be legitimate, and if you’re curious about learning about the specifics in detail, make sure to check them out.

Since I wanted the article to be perfect in English (which is not), I used AI to aid my writing, sometimes summarizing the parts completely while I just commanded it to do so, while reviewing if it makes sense

To learn more about basics of Cybersecurity, you can check this course, I am not affiliated in any way, I am doing this course for the sake of curiousity despite having some background already, it never hurts to review and even learn something new :).

I also prepared a little report with Qwen Chat regarding modern Cybersecurity, in case you want to check it out:

PDF: From CIA to Cyberwarfare