Learning Objectives
- Define computer security using confidentiality, integrity, availability (CIA).
- Distinguish a threat from a control.
- Preview unauthorized access, sabotage, malware, ethics, and cyber law.
Next: unauthorized access, crime, malware, ethics, cyber law, firewalls and encryption.
What security is
Computer security is the protection of systems and data from unauthorized access, use, disclosure, disruption, or destruction. The CIA triad:
- Confidentiality — only authorized people see the data (passwords, encryption).
- Integrity — data is not altered improperly (checksums, access control, backups).
- Availability — systems work when needed (redundancy, malware protection, UPS).
Privacy overlaps confidentiality but is also a legal and ethical claim about personal data.
Threats and controls
A threat is a possible harm (hacking, fire, insider abuse, ransomware). A control is a countermeasure: technical (firewall), administrative (policy, training), or physical (locked server room). Security is risk management: you rarely eliminate risk; you reduce it to an acceptable level.
Why BBA students study this
A leaked customer list or a locked accounting file is a business failure, not only an IT failure. Unit 9 connects technical controls to professional ethics and Nepal-relevant cyber and IP law (chapter 7).
Key Takeaways
- CIA is the standard definition of security goals.
- Controls answer threats; both must be named in long answers.
- Ethics and law sit beside antivirus and firewalls.
Discussion Questions
- Give one control for each of C, I, and A.
- Can a system be confidential but unavailable? Why is that still a security failure?
- Who is responsible for security in a 10-person firm?
