We bandy the term ‘secure’ and ‘security’ around easily when discussing cybersecurity, but what do we actually mean?
Security is fundamentally a cornerstone of trust. Our goal in securing something is to protect it in a trustworthy way.
The most common example of this need in everyday use is turning an unsecure medium (like the internet) into something trustworthy. There is no inherent security provided by the internet. To provide a secure connection, we need to overlay the internet with additional tools, protocols, and algorithms that deliver the security needed. But we also need to think of security when the data are not on the move, e.g., when stored in a database on a company server.
But what do we mean by ‘secure?’ What do we need to do to have trust in a connection, and the data we exchange across that connection?
Security requires three essential factors, sometimes referred to as the CIA Triad. The first, which is well recognised, is that we need to provide Confidentiality. We don’t want others being able to access and see our data unless authorised. Despite it being what we seek most from security, while confidentiality is a fundamental necessity for security, it is not in itself sufficient.
In addition to confidentiality we need Integrity and Availability.
Integrity means the data must remain accurate, complete, and unaltered unless changed by an authorised person. If I ask my bank to transfer $100 to Kim, but the instruction they receive is to send $10,000 to Pat, the message is not secure. If the data can be altered, even without being disclosed (i.e., an issue of confidentiality), we do not have security.
Finally, the data and the systems to use them need to be available and accessible to authorised users when permitted and required. Security therefore extends to the prevention of outages, maintaining uptime, and defeating denial of service.
Cybersecurity means the correct operation of computer systems to maintain confidentiality, integrity, and availability. A failure to deliver any one of these three is a cybersecurity incident.
In addition, there are four other key security goals that are complementary to the CIA Triad. These are authentication – proving who someone is; authorisation – a framework determining what someone can and cannot do on a system; accountability – knowing who did what; and non-repudiation – preventing someone from denying an action they performed (normally by proving only they could have done it). These goals are needed to establish identity, control access, and provide trustworthy audit trails.
Security is More than Just Confidentiality
Every business has information it wants to keep secret – which is the essence of confidentiality, If we are only worried about confidentiality, we could simply lock our data away in an impenetrable fortress. If no one can get in to access our data, it is secure. Unfortunately, an impenetrable fortress is also highly impractical. A business relies on those data to perform its business. We need to know the data hasn’t been inappropriately changed, and we need to ensure authorised people can get access to the data when needed. We then need to know who accessed what, did what, and when in a way the user can’t later deny.
To operate secure systems, we need to implement all seven of the above factors. The specific methods and protocols may vary from firm to firm, system to system, or need to need. All of them, to varying degrees, are essential for every business.
Consider the situation where you send an invoice to a customer. A bad actor doesn’t need to read the invoice in order to cause serious damage. If they can intercept the message and change the bank account number before it reaches your customer, the payment could end up in their account instead of yours. The information in the invoice wasn’t leaked, but it was corrupted in a way that enriches them. This is an issue of data integrity rather than confidentiality.
Most ransomware attacks are designed to limit access to your own data rather than stealing your data (which might be a secondary outcome). The bad actor can just encrypt your data. You are locked out, which may result in your business grinding to a halt. This is an issue of accessibility rather than confidentiality.
Similarly, you receive an email from your bank. It seems authentic, it is even encrypted. How can you trust it is from your bank and not some bad actor masquerading as your bank? You need to ensure the identity of the sender to be able to trust the message.
These are some simple examples of how cybersecurity isn’t just about about secrecy. A truly secure system must also ensure that information hasn’t been altered, that systems remain available when they’re needed, and that the identities of the people and organisations involved can be trusted.
The traditional CIA Triad teaches us that information should remain confidential, accurate and available. Those principles are still fundamental, but in today’s interconnected world we need to do more. Every online information begs these questions: Who is this person? Are they allowed to perform this action? Can we prove what happened if there’s a dispute? These concerns introduce four additional security goals: authentication, authorisation, accountability and non-repudiation. Collectivity they transform security from simply protecting information to establishing trust between the parties to a transaction..
Authentication: Are You Really Who You Claim to Be?
Authentication is the process of proving an identity. Before an employee can access the company’s accounting system, they must demonstrate that they are who they claim to be, perhaps by using a passkey or another form login-based authentication. The system isn’t interested in what the employee wants to do yet; it first needs confidence that the person logging in is genuinely Jane from Accounts and not someone who has stolen her laptop or guessed her password.
Traditionally, we have relied on a username/password combination for authentication. The major weaknesses to this method is that a password can be shared or stolen. A username/password tells us the account that has logged in, but is not strong enough to ensure it is the actual person who is associated with that account. Using multi-factor authentication can make the authentication process more likely to identify who has logged in, but technologies such as passkeys are needed to provide a high-enough level of trust as to who has logged in.
Authorisation: What Are You Allowed to Do?
Once Jane’s identity has been confirmed, the system must know what she is permitted to do in the system. This is authorisation, and associates permissions to the account at log in. Jane may be authorised to create supplier invoices and approve payments up to $10,000, while larger payments require approval from the Finance Manager. Even though another employee has successfully authenticated, they may have a completely different set of permissions. Authentication answers who are you? Authorisation answers what are you allowed to do?
Permissions are typically linked together into roles and groups. Roles and groups offer an easy way to associate permissions to particular classes of users, enabling a shortcut way to alter the permissions of groups of users in one place rather than needing to update each account. You may have used this type of permission management with Windows-based servers. If Jane is a member of a role called Accounts Clerks then she has the permissions associated with this role. In addition, if Jane is based in the Singapore office, she would be a member of the Singapore group, which could, for example, provide permissions around which printers she has access it, hours of access, and whether she can use her laptop remotely to access particular servers. Users can be members of multiple roles and groups in most cases. In addition, Jane may have permissions associated specifially to her account, e.g., access to bank account or payroll information.
Accountability: Who Did What?
As Jane works, the accounting system records her actions in an audit log. It notes when she logged in, which device she used, a list of supplier invoices she approved, the amount, the time of the approval, and any subsequent changes. This audit trail creates accountability. If a payment is later questioned or an error is discovered, the business has a reliable record showing exactly who performed each action. Accountability isn’t about preventing mistakes; it’s about ensuring that actions can be traced back to the responsible individual.
For an audit trail to be truly effective, you need to have strong authentication. It is not enough to say Jane’s account did these things at these times. You need a higher level of certainty. You need to ensure you know that Jane was operating her account – to the extent possible.
Non-Repudiation: Can Someone Deny They Performed the Action?
Finally, Jane digitally signs the supplier payment using her private key. Because only Jane possesses that private key, the digital signature provides strong evidence that she authorised the transaction. Months later, if a dispute arises, Jane cannot credibly claim that someone else approved the payment rather than her. This is known as non-repudiation: creating evidence that binds a person to a particular action. While accountability records who appears to have done something, non-repudiation provides cryptographic proof that the action was genuinely authorised by that individual.
Digital signatures rely on the same public key cryptography methods discussed previously, but in reverse. I use my private key to encrypt some information. Only the associated public key can unlock (decrypt) the information. That public key – the one that is freely available to anyone, i.e., not a secret – can only be used to unlock that private key’s output. Again, the private key itself is not disclosed. This method works for digital signatures because of the 1:1 relationship between private and public keys. Anyone can read the signature because the public key is freely available.
The Cost Benefit Analysis for Cybersecurity
Implementing these technologies and methods comes at a cost. Most of the cost is the direct expense of buying or subscribing to the various products needed in your business, but there are second-order and non-financial costs to consider as well.
Cybersecurity isn’t just a technical problem; it’s also an investment decision, much like insurance, health and safety, or quality control. The goal isn’t to try to eliminate all risk, because that’s neither practical nor affordable. The goal is to reduce risk to a level that makes commercial sense to your business.
Many businesses get this balance wrong in one of two ways. Some dramatically underinvest, assuming that cybercriminals only target large corporations or that “it won’t happen to us.” They focus on the upfront cost of a cybersecurity solution while ignoring the potentially enormous cost of a successful attack.
On the other hand, other business owners make the opposite mistake: investing in expensive security products and services without understanding the risks they actually face. They buy technology because it sounds reassuring, not because it addresses their most significant vulnerabilities.
For both of these groups, there is a common issue: a lack of understanding of the risks in a business sense.
Good cybersecurity begins with an understanding of the risks your business faces. You can think of risk as a lens on your business combining likelihood and impact. How likely is a particular attack to occur? If it does occur, what would it cost? A risk that has an extremely low likelihood of happening, but a very high cost to the business if it does occur needs to be considered and a mitigation plan developed (both to protect from and recover from that risk). A low-impact, low likelihood issue might not be specifically addressed at all. You need to use this lens to determine how much to spend to mitigate these risks.
When considering the cost of a successful attack, you also need to think well beyond the immediate financial loss. A successful cyberattack can interrupt operations for days or weeks, damage customer confidence, expose confidential information, attract regulatory penalties, consume management time, and result in lost future business. For many businesses, the disruption can be more damaging than the direct financial loss itself.
Methods like public-key cryptography, digital certificates, and passkeys matter. These technologies aren’t simply clever pieces of mathematics; they are controls that reduce specific business risks. They make phishing attacks more difficult, protect confidential communications, verify the identity of websites, and reduce opportunities for fraud. Like any investment, however, they should form part of a broader, risk-based security strategy rather than being viewed as a silver bullet.
There is no valid generic risk assessment you can pick up and use. A risk assessment needs to factor in the specifics of your business and your appetite for risk.
Ultimately, good cybersecurity is about making informed business decisions. Every dollar spent on security should reduce a meaningful risk, and every significant risk should have a proportionate control. Businesses that understand both the likelihood and the consequences of cyber threats are far more likely to invest wisely than those driven solely by fear or complacency. In the end, the objective isn’t to build an impenetrable fortress. It’s to build a business that is resilient enough to withstand the threats it is most likely to face.