Oak Valley Accounting has 40 employees and handles client tax returns, payroll filings, and refund calculations. A stolen laptop contains client tax PDFs, a changed spreadsheet produces incorrect refund totals, and an unavailable file server prevents staff from submitting payroll filings on time. An attacker did not need to break every system to harm the firm. Access to one laptop, one spreadsheet, or one server was enough. These failures lead to the three security goals we will use throughout the course.
The three goals are confidentiality, which keeps client tax PDFs from people who are not authorized to read them, integrity, which keeps the refund spreadsheet accurate and prevents unauthorized changes, and availability, which keeps the file server reachable when staff need payroll records. Together, confidentiality, integrity, and availability form the CIA triad.
The stolen laptop is a confidentiality failure because an unauthorized person may read names, addresses, income records, and tax documents. A password on the laptop and device encryption help prevent that exposure, while sign-in logs and a report of a missing device help Jordan Lee, Oak Valley’s IT generalist, detect that the protection may have failed.
The altered refund spreadsheet is an integrity failure because staff may make decisions using figures that no longer match the approved records. Restricting who can edit the spreadsheet helps prevent changes, and reviewing version history or unexpected changes to refund totals helps detect them. The crucial distinction is that an available spreadsheet can still be unsafe when its numbers are wrong.
The offline file server is an availability failure because Sam Rivera cannot retrieve client records needed for payroll filings. Backups, redundant storage, and recovery procedures can restore access, while server uptime alerts and failed file-access events reveal the interruption. A system can protect secrecy and accuracy yet still fail the business when authorized staff cannot use it.
A control can improve one goal while creating pressure on another. Requiring extra approval before every file change protects integrity, but the approval process may delay urgent work and reduce availability. An analyst must first state which CIA goal is at risk, then choose a control and a signal that can show whether the control failed. The comparison below ties each goal to Oak Valley’s systems.
This table shows that every CIA concern has both a prevention measure and evidence an analyst can monitor. Security work is not only blocking an attacker. Security work also means noticing the missing laptop, altered record, or unavailable service quickly enough to respond.
Exam rule Confidentiality prevents unauthorized disclosure, integrity prevents unauthorized alteration, and availability preserves authorized access when needed.
Because CIA applies to specific assets rather than to the firm in general, we need a shared map of where Oak Valley stores and moves information. Maya Patel, the managing partner, and Sam use Windows 11 laptops on the office Wi-Fi. Their laptops send and receive client messages through Microsoft 365 email, access client tax PDFs on the on-premises file server, and sign in to QuickBooks Online for accounting records.
Sensitive data lives in several places. The file server holds client tax PDFs and shared spreadsheets. Microsoft 365 mailboxes may hold attached tax documents and payment instructions. QuickBooks Online holds financial records, and a laptop may temporarily store downloaded files. Jordan’s small administrator account boundary matters because an account with broad system access can affect many of these locations at once.
Data moves across paths that later threats will target. A phishing email arrives from the internet through Microsoft 365, a staff member opens it on a laptop, and credentials or files may then reach another system. File access moves between laptops and the file server. QuickBooks access moves from a laptop across the internet to the online service. The diagram fixes these systems and boundaries in place for later analysis.