L20
CIA triad, vulnerability, threat, exploit and risk
Cram this first — memory hook
Confidentiality = secret; integrity = correct; availability = usable. Weakness → exploit → harm is a possible chain, not an inevitable result.
Exam trap
An incident can affect several goals. Answer the primary impact described by the question rather than assuming only one goal can ever be involved.
The slide facts
The security goals are confidentiality, integrity and availability. The vulnerability slides address zero-days, unpatched/legacy systems and assessments.
If you have time — extra
Confidentiality means information is accessible only to authorized parties. Integrity means it remains accurate and is changed only as authorized. Availability means people can use the service when needed. The Confidentiality, Integrity and Availability () triad is a way to describe security goals, not three products to purchase. A vulnerability is a weakness; a threat is a possible cause of harm; an exploit is a means of taking advantage of a weakness; risk considers the likelihood and impact of harm. A known vulnerability with an available patch is different from a zero-day vulnerability unknown to, or not yet practically addressed by, responsible defenders. Do not classify every unpatched old bug as zero-day. Legacy systems may be risky because support and security updates have ended. Vulnerability assessment identifies and prioritizes weaknesses; an open port is evidence to assess, not automatically an exploitable flaw.
Walkthrough
Identify what could be harmed, name the weakness and threat, identify the relevant goal, assess exposure/impact, choose controls, and check whether risk is reduced.