Mapping Threats

Eavesdropping and man-in-the-middle concepts on insecure networks aim at reading traffic that should stay private. The defender's mindset is prefer HTTPS, avoid sensitive work on shady Wi-Fi, and type known destinations yourself — not "practice sniffing the café." Credential stuffing and account takeover use leaked password reuse to open private mail and cloud drives: Confidentiality fails when the wrong person reads what only you should see. Spyware that uploads photos or screenshots is the same pillar even when files are not edited.

First defensive instincts for C-primary events: revoke sessions, rotate passwords on unique values, enable MFA, remove malware if present, review sharing links, and treat leaked personal details as fuel for follow-on social engineering. Do not "hack back." Do not visit the attacker's site to confront them. Contain disclosure, then harden.

Website defacement swaps homepage truth for a fake message while the site may stay online — readers see altered content; Availability is not the primary label just because the topic is important. Record tampering changes grades, balances, or sensor readings without authorization. Malicious update and supply-chain concepts replace a trusted installer with a trojaned build; hashes and signatures are how defenders catch swaps relative to published good bytes. The shared mechanism is silent or visible alteration of authorized truth.

First defensive instincts for I-primary events: restore known-good content from trusted backups, verify CMS and publish accounts, check logs for unauthorized writes, compare hashes/signatures on software, and separate read from modify permissions going forward. Importance of the topic (elections, medicine, finance) raises impact; it does not relabel Integrity as Availability.

DDoS overwhelms a service so real users cannot connect. Resource exhaustion and destructive wipers fill CPU/disk or wipe systems so work stops. Physical disruption — power, cooling, cable damage — takes systems offline without needing malware. Ransomware lockout, as you saw, is often Availability first even when other pillars join. The shared mechanism: authorized people cannot complete their job on the system.

First defensive instincts for A-primary events: filter and scale where you operate infrastructure, fail over, restore from offline backups, replace failed hardware, free disk space on devices you own, and schedule patches so updates do not become self-inflicted outages. Never "practice" floods against a public site. Never delete shared class resources to simulate outage.

Ransomware with leak threats is A + C (+ maybe I). Phishing that leads to stuffed mail is often C first. A poll number changed on a live news page is I first. When two pillars fit, pick the primary harm that drives the first hour of response, then note secondary pillars. The map is a prioritization tool, not a prison. Wrong maps waste the first hour: treating defacement as "Availability because elections matter" sends people to capacity engineering instead of CMS integrity and account takeover.

Use a one-sentence template until it becomes automatic: "Primary pillar is X because the authorized failure mode was Y; first defensive instinct is Z." Example: "Primary pillar is Confidentiality because private photos left the device without permission; first instinct is remove spyware and rotate secrets." Example: "Primary pillar is Integrity because published numbers were altered while the site stayed up; first instinct is restore known-good CMS content and audit publisher accounts." Example: "Primary pillar is Availability because checkout cannot complete under flood; first instinct is filter/failover — never retaliatory floods." Write three of those sentences from public headlines in the mission below. That is how mapping becomes usable under pressure.

Fill a one-page map you can reuse. Drill with public headlines: one word C/I/A, one defensive action. Keep notes in $HOME/cyberlium-lab if you want. Ethical scenarios only — no attempts.

Threat                         | Primary CIA pillar | First defensive instinct
------------------------------|--------------------|---------------------------
Phishing → stolen password    | Confidentiality    | Reset creds + MFA
Altered invoice amount        | Integrity          | Dual control / restore / verify
DDoS flood                    | Availability       | Filter / scale / failover
Ransomware lock + leak threat | A + C (+ maybe I)  | Isolate + restore + IR
Spyware screenshots           | Confidentiality    | Remove malware + rotate secrets
Homepage defacement (site up) | Integrity          | Restore CMS + audit publishers
Full disk / failed restore    | Availability       | Free space / tested backups

You can now classify threats by pillar and choose a first defensive move without confusing importance with Availability or disclosure with Integrity. Next — Quiz: CIA Triad Mastery — then Module 3 begins with Authentication vs. Authorization.