Learning Objectives

  • Define computer security using confidentiality, integrity, availability (CIA).
  • Distinguish a threat, a vulnerability, and a risk.
  • Classify controls as preventive, detective, or corrective, and as technical, administrative, or physical.
  • Preview unauthorized access, sabotage, malware, ethics, and cyber law.

Next: unauthorized access, crime, malware, ethics, cyber law, firewalls and encryption.

What security is

Computer security is the protection of systems and data from unauthorized access, use, disclosure, disruption, or destruction. The CIA triad:

  • Confidentiality — only authorized people see the data (passwords, encryption).
  • Integrity — data is not altered improperly (checksums, access control, backups).
  • Availability — systems work when needed (redundancy, malware protection, UPS).

Privacy overlaps confidentiality but is also a legal and ethical claim about personal data.

flowchart TB
  SEC[Computer Security Goals]
  SEC --> C[Confidentiality: authorized access only]
  SEC --> I[Integrity: data not altered improperly]
  SEC --> A[Availability: systems work when needed]

Figure 1: CIA Triad Security Goals

CIA in a bank

Goal What failure looks like Example control
Confidentiality A customer’s balance is visible to outsiders Login with OTP, encrypted connections
Integrity A clerk changes a loan amount without approval Maker–checker approval, audit logs
Availability Mobile banking is down on salary day Backup servers, DDoS protection, UPS

Threats, vulnerabilities, and risk

  • A threat is a possible harm (hacking, fire, insider abuse, ransomware).
  • A vulnerability is a weakness a threat can exploit (an unpatched system, a weak password, an unlocked server room).
  • Risk is the likelihood that a threat exploits a vulnerability, combined with the damage it would cause.

A ransomware gang (threat) exploits an unpatched Windows server (vulnerability). If that server holds all accounting data and there is no backup, the risk is high.

Threats and controls

A threat is a possible harm (hacking, fire, insider abuse, ransomware). A control is a countermeasure: technical (firewall), administrative (policy, training), or physical (locked server room). Security is risk management: you rarely eliminate risk; you reduce it to an acceptable level.

Types of controls

By form

  • Technical (logical): passwords, multi-factor authentication, firewalls, encryption, antivirus.
  • Administrative: security policies, staff training, background checks, access approval procedures.
  • Physical: locks, ID cards, CCTV, fire suppression, UPS and generators.

By purpose

  • Preventive — stop an incident before it happens (firewall, strong passwords, locked doors).
  • Detective — discover an incident in progress or afterwards (audit logs, intrusion detection, CCTV).
  • Corrective — recover and limit damage (backups, disaster recovery plans, patching after an attack).

Common threats at a glance

Category Examples
Human error Deleting files, sending data to the wrong email, weak passwords
Malicious insiders Employees stealing or altering data
External attacks Hacking, phishing, malware, ransomware, denial of service
Physical/natural Theft, fire, flood, earthquake, power failure

Why BBA students study this

A leaked customer list or a locked accounting file is a business failure, not only an IT failure. Unit 9 connects technical controls to professional ethics and Nepal-relevant cyber and IP law (chapter 7).

Nepal context

  • In 2017, attackers used NIC Asia Bank’s SWIFT payment system to send fraudulent international transfers; most of the money was later recovered, but the case pushed Nepali banks to strengthen controls.
  • Nepal Rastra Bank issues IT and cybersecurity guidelines that require banks to apply controls such as access management, audit logs, and business continuity planning.
  • Phishing messages imitating banks and wallets are a common threat, which makes user awareness training a key administrative control.

Key Takeaways

  • CIA is the standard definition of security goals.
  • Threats exploit vulnerabilities; risk combines likelihood and impact.
  • Controls can be technical, administrative, or physical, and preventive, detective, or corrective.
  • Controls answer threats; both must be named in long answers.
  • Ethics and law sit beside antivirus and firewalls.

Discussion Questions

  1. Give one control for each of C, I, and A.
  2. Can a system be confidential but unavailable? Why is that still a security failure?
  3. Who is responsible for security in a 10-person firm?

Exam-Style Questions

Short answer

  1. What is the CIA triad? Explain each element with an example.
  2. Differentiate between a threat and a vulnerability.
  3. Give one example each of preventive, detective, and corrective controls.

Long answer

  1. What is computer security? Explain the major threats to an organization’s information systems and the controls used against them.
  2. As the IT manager of a commercial bank, design a set of technical, administrative, and physical controls to protect customer data.