Types of Computer Security

Computer Network & Network Security System — Network Security, NEC licence examination syllabus (Nepal Engineering Council).

Types of Computer Security: what are we even trying to protect?

Before any encryption or firewall makes sense, you need to know what "secure" actually means.

🎯 The CIA Triad

ConfidentialityOnly authorized people can read the data. Real breach example: someone reading your private messages.

IntegrityData hasn't been secretly altered. Real breach example: someone changing the amount on a bank transfer.

AvailabilityThe system/data is accessible when legitimately needed. Real breach example: a DoS attack taking a website offline.

Every single security mechanism you'll study in this chapter — encryption, digital signatures, firewalls — exists purely to protect one or more of these three properties. Whenever you're unsure why a technique matters, ask "which of the CIA triad does this protect?"

💡 One-liner: classify a given attack (e.g. "an attacker deletes a company's database") under confidentiality/integrity/availability — this is a fast, easy mark if you know the triad cold.

The three properties pull against each other

The triad is usually presented as three goals to maximise. In practice they conflict, and every real security decision is a trade between them rather than an improvement in all three.

⚖️ Where they collide

Confidentiality vs availabilityStrict access control means locked-out legitimate users. A system that never wrongly denies anyone is a system that grants too readily.

Integrity vs availabilityRefusing anything suspect protects data and blocks genuine work. Accepting everything keeps things running and lets bad data through.

Confidentiality vs integrityEncrypted data cannot be inspected — including by the systems that would check it for tampering or malware.

So "make it more secure" is not a coherent instruction until you say which property and at whose expense. A hospital records system weights availability heavily — a doctor locked out during an emergency is a worse outcome than an over-broad access grant — while a military system inverts exactly that judgement.

💡 That framing turns a memorisation question into an analysis one. "Which property does a backup protect?" — availability, and possibly integrity if the live copy is corrupted, but backups actively harm confidentiality by creating another copy to steal.

The properties beyond the triad

🔐 Three more worth naming

AuthenticationVerifying who someone is. Distinct from authorisation, which is what they may then do.

Non-repudiationThe actor cannot later deny acting — what digital signatures provide and what plain encryption does not.

AccountabilityActions are traceable to an actor, which requires logging that is itself protected from tampering.

💡 Authentication and authorisation are constantly confused. Authentication is "who are you"; authorisation is "are you allowed to do this". A valid login that then refuses access is authentication succeeding and authorisation failing.

Syllabus points

Confidentiality, Integrity, Availability (CIA)
Security services/categories

Create a free account to tick topics off, take notes as you read, watch the video lessons and get a day-by-day study plan built around your exam date.