What you’ll be able to do
- Name at least three concrete assets in a small organization and say who is harmed if each is lost.
- Distinguish confidentiality, integrity, and availability using one system and three different loss stories.
- Write a loss sentence that names the asset, the people affected, and the property that failed before naming a control.
- Separate what is known about a loss from what is still uncertain.
Name the asset, not the shopping list
Riverstone Logistics is a fictional mid-size freight company used throughout this path. It runs YardOS for warehouse inventory, TrackPort so customers can see delivery windows, FleetLink so drivers and dispatchers share location, and a cloud identity directory that creates those accounts. The things worth protecting are not “the network” in the abstract. They are named records, processes, people, and physical goods: pallet locations, customer addresses, trailer Global Positioning System (GPS) locations, the identity that can disable a driver account, and the backup copies that would restart a warehouse after fire or ransomware.
An asset is anything whose loss, disclosure, alteration, or downtime would hurt a person or the business. If you cannot say who is harmed and how, you do not yet have an asset list. You have a vendor category. Start with the accounts, devices, records, and recovery copies that support a named activity. Ask their owners what would happen if each became unavailable or untrustworthy.
Confidentiality, integrity, and availability are different losses
The CIA triad is a way to name which property failed. Confidentiality fails when someone who should not see the data can read it: a contractor exports TrackPort delivery addresses. Integrity fails when data or a process is changed without authorization: a dock scanner is tricked into marking a high-value pallet empty so it can be stolen. Availability fails when authorized people cannot use the system in time: YardOS is encrypted and the morning wave of trucks cannot be loaded.
The same system can fail all three ways. Encryption that protects confidentiality does not restore a destroyed database. A backup that restores availability does not tell you whether the restored records were silently changed last week. Write the property into the sentence so later lessons on controls, logs, and products have something precise to attach to.
- Confidentiality: unauthorized disclosure of data or secrets.
- Integrity: unauthorized modification, including silent corruption.
- Availability: authorized users cannot use the asset when they need it.
- Uncertainty belongs in the sentence: a suspected export is not the same as a logged export.
Write the loss before you name the control
Beginners often jump from a feeling of unease to a product: “we should buy multifactor authentication.” Multifactor authentication (MFA) can reduce a confidentiality failure on TrackPort accounts, but only if account takeover was the loss you actually feared. If the feared loss is a forklift hitting the only on-site server, MFA does not help.
Practice this sentence: if X happens to asset Y, person Z cannot do W, and property P is the one that failed. Until that sentence is specific, a framework mapping or a product category is decoration. NIST’s Cybersecurity Framework 2.0 organizes outcomes such as Identify and Protect around this kind of scoping, not around a shopping list of tools.
CHECK YOUR JUDGMENT
A TrackPort export of customer delivery addresses is emailed to a personal inbox by a contractor who still used a shared warehouse login. Maya, the on-call analyst, must open the incident note. Which property failed first, and what belongs in the note?
NEXT FIELD LESSON