Cybersecurity Foundations·A security baseline you can use

Threat modelling and the CIA triad

Security starts by naming what you protect and who might attack it.

Beginner 13 min read Lesson 6 of 300 Challenge included

What you will be able to do

List the assets before listing technologies.
Name realistic actors and their capabilities.
Prioritise mitigations by impact and likelihood.

In plain English

Confidentiality, integrity and availability describe what can go wrong. A threat model lists assets, actors, entry points and mitigations. It is a design conversation, not a compliance document.

threat-model.mdText

Feature: certificate verification
Assets: credential status, holder display name
Actors: learner, employer, anonymous scanner, attacker
Entry points: public ID, QR URL, API route
Risks: enumeration, forged status, rate-limit abuse
Mitigations: opaque IDs, server-side lookup, no-store, rate limits, audit events

Your turn

Model a login form

Easy

List two assets, two actors and two mitigations for a login form.

TEXT · starter

Assets:
Actors:

Check your understanding before moving on.

Knowledge checkQuestion 1

Which property prevents an attacker from silently changing a credential record?

Select an answer to continue

Study tools

Make it yours.

Keep a private note for this lesson, then turn the key ideas into flashcards you can revisit.

Sign in to save notes and flashcards.Both are private to your account and stay with your progress.

Finished reading?

Lock in what you just learned.

Mark this lesson complete to save your place and move one step closer to the certificate.

Next: Authentication that resists guessing

Lesson 6 of 300 · 0% of course