Cost and Management Audit · Information Systems Security Audit

CIA Triad and Information Security Threats Explained

Updated 11 October 2026 · Fact-checked

Information security protects information through three goals: confidentiality (only authorised people see it), integrity (it stays accurate and unaltered) and availability (it is usable when needed). A threat is something that can cause harm; a vulnerability is a weakness it can exploit. To solve questions, identify the asset, threat, weakness, affected CIA goal and control.

Understand Information Security Concepts and Threats

Information security means protecting information and the systems that store and process it from misuse, damage and loss. For a cost or management auditor, the information is cost records, costing data, payroll, inventory and financial reports. If these are wrong or leaked, decisions and audit reports suffer.

The CIA triad is the base model. Confidentiality means only authorised users can access the information. Integrity means data is complete, accurate and changed only by authorised people in authorised ways. Availability means systems and data can be used when needed. A leaked tender price breaks confidentiality. A changed stock quantity breaks integrity. A server outage on a billing day breaks availability.

A threat is any event, person or program that can cause harm. A vulnerability is a weakness that a threat can exploit, such as an unpatched system, a weak password or no segregation of duties. Risk arises when a threat can exploit a vulnerability and cause impact. The threat is outside the weakness; the vulnerability is inside your system or process.

Common threats include malware (viruses, worms, trojans, ransomware, spyware), hacking (unauthorised access to systems), phishing (fake emails or messages that trick users into revealing credentials or clicking links), social engineering, denial of service attacks, and insider fraud by employees who misuse authorised access. Insiders are dangerous because they already know the system and have legitimate access.

A security policy is a written statement approved by management on how information is to be protected. It sets rules on access, passwords, acceptable use, data classification, incident reporting and backup. Policy comes first; procedures and technical controls implement it. An auditor checks that a policy exists, is approved, is communicated, and is actually followed.

Key rules to remember

CIA triad: Information security = Confidentiality + Integrity + Availability; Name the goal that is breached in each scenario. One incident can breach more than one goal.
Risk relationship: Risk arises when Threat exploits Vulnerability and causes Impact on an asset; A threat without a matching vulnerability gives little risk. Fixing the vulnerability reduces risk.
Threat versus vulnerability: Threat = potential cause of harm; Vulnerability = weakness that can be exploited; Example: phishing email is the threat; untrained staff is the vulnerability.
Control types: Preventive, Detective, Corrective; Match the control to the stage: stop it, spot it, or recover from it.

How to solve Information Security Concepts and Threats questions

Use this sequence for any scenario or descriptive question on security concepts and threats.

1Identify the asset at stake, such as costing data, payroll file or ERP server.
2Identify the threat in the scenario: malware, hacking, phishing, insider fraud or another.
3Identify the vulnerability that allowed it, such as weak passwords, no patching, poor training or excess access.
4Map the incident to the CIA goal or goals breached, and say why.
5State the likely impact on records, decisions, compliance or reputation.
6Recommend controls: policy, access control, training, patching, backups, monitoring. Label them preventive, detective or corrective.
7Close with the auditor's role: review the policy, test whether controls operate, and report gaps.

Quickest way: Threat-Weakness-CIA-Control (TWCC) check

When to use it: Use for MCQs and for short case scenarios when time is tight.

Underline what happened: leak, change, or outage.
Leak means confidentiality, change means integrity, outage or lockout means availability.
Ask who acted: outsider, insider or software. That fixes the threat type.
Name the weakness in one phrase.
Pick the control that closes that weakness and tag it preventive, detective or corrective.

Common mistakes in Information Security Concepts and Threats

Using threat and vulnerability as the same thing.
Both words describe what can go wrong, so they feel alike.
Fix: A threat acts from outside the weakness; a vulnerability is the weakness itself. Write both separately in answers.
Mapping every incident to confidentiality only.
Security is often thought of as keeping secrets.
Fix: Ask whether data leaked, changed or became unusable. Ransomware that locks files mainly hits availability.
Ignoring insider fraud and listing only external hackers.
News stories focus on outside attacks.
Fix: Always mention insiders. Controls include least privilege, segregation of duties, logging and review.
Treating a security policy as a technical tool.
Students mix policy with firewalls and antivirus.
Fix: Policy is a management-approved document of rules and intent. Technical tools implement it.
Giving a list of controls without linking to the scenario.
Students recall generic lists from notes.
Fix: Tie each control to the specific weakness in the case and say whether it prevents, detects or corrects.

Worked examples

Example 1

A clerk at Kaveri Components Ltd. receives an email that appears to be from the bank and enters the ERP login on a fake page. The attacker then edits the standard cost of three products. Identify the threat, vulnerability, CIA goals breached and two controls.

Show the solution

Threat: phishing by an external attacker, followed by unauthorised access using stolen credentials.
Vulnerability: the clerk was not trained to spot fake emails, and login relied on a password alone.
Confidentiality was breached because the credentials were exposed to an unauthorised person.
Integrity was breached because the standard costs were altered without authority.
Preventive controls: awareness training and multi-factor authentication.
Detective control: logging of changes to cost master data with review by a supervisor.

Answer: The threat is phishing leading to unauthorised access; the vulnerability is untrained staff and password-only login. Confidentiality and integrity were breached. Training, multi-factor authentication and reviewed change logs would prevent or detect it.

Example 2

Distinguish between a threat and a vulnerability with two examples each relevant to a manufacturing company's costing system.

Show the solution

Define a threat: any event, person or program with potential to harm an asset.
Define a vulnerability: a weakness in system, process or people that a threat can exploit.
Threat examples: ransomware that encrypts costing files; a dissatisfied employee who manipulates inventory data.
Vulnerability examples: operating system not updated with security patches; one user holding rights to both create and approve material issues.
Link them: ransomware exploits the unpatched system, and the employee exploits the lack of segregation of duties.
Conclude that risk is reduced by closing vulnerabilities, since threats cannot be fully controlled.

Answer: A threat is a potential cause of harm, such as ransomware or insider manipulation. A vulnerability is the exploitable weakness, such as unpatched software or no segregation of duties. Risk exists where a threat can exploit a vulnerability, so management reduces risk mainly by fixing vulnerabilities.

Exam tips

In MCQs, decode the scenario by verb: leaked means confidentiality, altered means integrity, unavailable means availability.
In case answers, structure as asset, threat, vulnerability, CIA impact, controls. Examiners look for this chain.
Always mention insider fraud when asked for threats, and pair it with least privilege and segregation of duties.
Define terms in one line before applying them. Definitions earn quick marks.
End with the auditor's role: review the policy and test whether controls actually operate.

Practice questions from Information Systems Security Audit

Information Security Concepts and Threats in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Information Security Concepts and Threats: frequently asked questions

What is the CIA triad in information security?

It is the three core goals of information security: confidentiality, integrity and availability. Confidentiality limits access to authorised users, integrity keeps data accurate and unaltered, and availability keeps systems usable when needed.

What is the difference between a threat and a vulnerability?

A threat is something that can cause harm, such as malware or a phishing email. A vulnerability is a weakness that the threat can exploit, such as weak passwords or unpatched software. Risk exists when both meet.

Why is insider fraud considered dangerous?

Insiders already hold authorised access and know how processes work, so they can bypass many external defences. Controls such as least privilege, segregation of duties, activity logs and independent review help limit it.

What does a security policy do?

It is a management-approved document that sets the rules for protecting information, such as access, passwords, acceptable use and incident reporting. Procedures and technical controls are built to implement it.