Session 1: Threats, Risk & the CIA Triad

Security is not one thing; it is three, and every control you will ever apply serves at least one of them. Confidentiality means the wrong people cannot read it — your bank details, your customers' data, your business's pricing. Integrity means nobody can change it without you knowing — a transferred amount, a contract, a database record. Availability means it is there when you need it — your files, your systems, your ability to trade.

The triad is genuinely useful because it turns vague worry into specific questions. 'We need security' means nothing. 'An attacker could read our customer list' is confidentiality. 'Someone could alter an invoice before it is paid' is integrity. 'Ransomware could stop us trading for a week' is availability. Once you can name which of the three is at stake, you can reason about what to do, and you can explain it to a client or an employer in one sentence.

Notice also that the three trade against each other and against convenience. Strong confidentiality usually means more authentication steps, which reduces availability and annoys users. Perfect availability — everything public, no passwords — destroys confidentiality. Security work is choosing the balance for the actual risk, not maximising all three, which is impossible.

Four words that people use interchangeably and should not. A threat is anything that could cause harm — a thief, a ransomware campaign, a fire, a careless employee. A vulnerability is a weakness in your specific setup that a threat could exploit — an unpatched system, a reused password, an unattended unlocked laptop, a business with no backup. A risk is the combination: the likelihood that a threat exploits a vulnerability, multiplied by the impact if it does. And a control is what you put in place to reduce either the likelihood or the impact.

This distinction is the whole discipline. A threat you cannot do anything about — criminals exist — is not actionable. A vulnerability you own is. So the work is finding your vulnerabilities, estimating the risk each creates, and applying controls where the risk justifies the cost. That is why a security professional asks 'what could go wrong here, how likely, and how bad?' rather than reciting a list of famous attacks.

It also produces honest prioritisation. A small Nigerian business whose only computer holds customer records faces a real availability risk from ransomware with no backup, and a real confidentiality risk from a shared password written on a note. It does not face a meaningful risk from a nation-state actor. Spending money on the wrong risk is a failure even when the money buys genuine security, because the actual exposure is elsewhere.

For an individual or a small business in Nigeria, the realistic threats are mundane and financially motivated. Account takeover — someone obtaining your password and draining a bank account, an email inbox or a social account — is the most common serious loss. Phishing and impersonation, particularly on WhatsApp, where a message from a number posing as a relative, a bank or a delivery company asks for a code or a payment. Fraudulent payment requests and fake alerts, aimed at businesses that accept transfers.

Ransomware and destructive malware, which arrives through a pirated software download, a cracked activation tool, or an attachment, and encrypts everything — devastating for a business with no backup. Device theft or loss, which is a data breach if the device holds customer information and is not encrypted. And insider risk, which is not usually malice: a staff member who shares a password, leaves an account logged in on a shared machine, or falls for a scam while acting for the business.

What is notably not a realistic threat for most people here: a targeted attack by a sophisticated actor. Those exist and they matter to banks and governments, but designing a small business's security around them wastes money that would do far more good on backups, passwords and staff awareness. Saying this plainly to a client is part of the job.

The majority of successful attacks on ordinary people and small businesses succeed because a person did something reasonable — clicked a plausible message, reused a password, shared a code to be helpful. Technical controls fail far less often than human ones, which is why awareness matters more than any product you could buy.

But framing this as 'users are stupid' is both unkind and useless, because it produces no improvement. The accurate framing is that attackers design for normal human behaviour. A message that arrives at the right moment, from an apparently known sender, asking for something small and urgent, exploits helpfulness and time pressure — traits that are virtues in every other context. People are not the weak link; the systems that let one mistake be catastrophic are.

The practical conclusion is to design so that a single mistake is survivable. Two-factor authentication means a stolen password alone is not enough. A backup means ransomware is an inconvenience rather than a disaster. Encrypted storage means a lost phone is a replacement cost rather than a breach. Every one of those converts a human error into a non-event, which is a far better outcome than training people never to make one.

Security spending is a series of trade-offs, and the discipline is to buy the control that reduces the most risk per naira. For an individual or small business, the ranking is remarkably consistent. Backups first, because they turn the worst realistic outcome — total data loss — into an inconvenience, and they cost almost nothing. Two-factor authentication on email, banking and social accounts, because it neutralises the most common serious attack. A password manager with unique passwords, because reuse is how one breach becomes every breach.

Then updates, which close the vulnerabilities that malware actually exploits; device encryption, which makes theft survivable; antivirus, which catches the common malware that reaches ordinary machines; and staff awareness, which is free and compounds. Only well down the list come the things that sound impressive — firewalls with complex rules, penetration tests, security appliances — which matter for larger organisations and are largely wasted on a two-person business.

The honest test of any control is: what specific risk does it reduce, and by how much, and what does it cost in money and friction? If you cannot answer those three questions, you are buying reassurance rather than security. Being able to say that to a client — and to say 'you do not need this' — is what makes you trustworthy rather than merely alarming.