What is computer security

Starting from a road you cannot trust

When you send a message over a network, it leaves your hands and passes through many points along the way: routers, a telecom company's equipment, other people's servers. You cannot know that all of them are safe.
Somewhere along the way, someone might peek at the contents, quietly change them, or grab the message and stop it from arriving at all. You do not need to know how such attacks work. The starting point is simply this: never trust the road blindly.

Follow the road from sender to receiver and tap each risk in turn. Secret reading, tampering and interception can all happen on the way.

All three could happen on the road: secret reading, tampering and interception. Look closely and each one breaks something different. If the message is read, the secret leaks; if it is changed, you cannot trust what it says; if it is intercepted, what should arrive never does.
So there is more than one thing to protect, and security splits it into three goals.

Three things to protect: confidentiality, integrity, availability

Security's goals come down to three. The first is confidentiality: only the intended people should be able to read the contents, and if someone reads them secretly, confidentiality is broken. The second is integrity: the contents should not change without permission, and if even one letter is different, integrity is broken.
The third is availability: the service should be usable without obstruction when it is needed, and if a server is knocked out or the road is blocked, availability is broken. Attacks that deliberately flood a server with requests until it fails are aimed squarely at availability. Taking the first letters of the three gives the name CIA.

Tap confidentiality, integrity and availability one at a time. Each shows what it protects and what happens when it breaks.

Seen separately, the difference is clear. Confidentiality means not being read, integrity means not being changed, and availability means being usable at any time. Even for the same message, the three can break separately: if no one read it, confidentiality held, but if the contents changed meanwhile, integrity is broken.
So the three goals need looking after separately. Notice, though, that these are only things we want to protect; we have not yet said how to protect them. Protecting a goal takes a method.

One means: checking who someone is

There are many ways to protect these goals, and the first you meet is authentication. Authentication checks that the other side really is the person they claim to be. On an unfamiliar road, just giving a name is not enough, because anyone can give someone else's name.
So we ask for something only that person knows. A password is the most familiar example; codes sent to your phone, fingerprints and faces are also used to confirm who you are. Show the right one and you are accepted as yourself; show the wrong one and you are not let in.

Of the three below, pick the secret only you know and go through the door. The right choice gets you accepted; any name or someone else's guess is blocked.

Showing the secret only you know opened the door. That is how authentication sorts out who someone is. But authentication is a means, not a goal. It does not keep a secret by itself; by filtering out the wrong people it helps protect goals such as confidentiality.
There are many means besides authentication: encryption, which scrambles contents so others cannot read them, and hashing, which can show whether contents have changed. Putting goals and means side by side makes the difference easy to see.

Goals and means go in different boxes

Let's separate the two clearly. A goal is something you want to protect: confidentiality, integrity and availability. A means is a way of protecting a goal: authentication, encryption, hashing.
There is a reason they are often confused: means and goals are always talked about in pairs. Encryption is a means, but the goal it serves is confidentiality. Sorting cards into a goals box and a means box makes this clear at a glance. When someone says they used encryption, the next questions are which goal it protects and what protects the others.

Tap each card to sort it into the goals box or the means box. Confidentiality, integrity and availability are what to protect; authentication and encryption are ways to protect them.

With every card sorted, it is all tidy: one box holds the goals to protect, the other the means that protect them. Keeping the two apart is the starting point of a security mindset.
Whatever security story you hear, ask first: is this a goal to protect, or a way to protect it? Mistake a means for a goal and you can easily lose sight of the real goal, the way having a password does not guarantee that your data cannot be changed.

Wrapping up

In short, a network is a road you cannot trust. So security sets three goals: confidentiality, integrity and availability (CIA). These are goals to protect, not methods.
The means that protect them are separate, and authentication, checking who someone is, is one of them. Deciding what to protect and choosing how to protect it: that is security.

Tap the key points in order to review. (a road you cannot trust → the goals are confidentiality, integrity and availability → one means is authentication → telling goals from means)

Now you know what security asks: what to protect, and how. These two questions are the backbone of all security. The three goals will keep coming back, and authentication is only the first of many means to protect them.
The next lesson covers hashing, which turns a password into a fingerprint that cannot be reversed, so the password itself never has to be stored. Hashing is also used to check whether contents have changed. Every lesson ahead can be read with the same two questions in mind: what is being protected, and how.