Everything in security reduces to three promises
Confidentiality — only authorized eyes (encryption, access control, DLP). Integrity — data stays unaltered (hashing, code signing, least privilege). Availability — systems work when needed (redundancy, backups, DDoS defense).
Every control you'll ever study maps to one or more of these. Every incident report describes which broke.
Risk = Threat × Vulnerability × Impact
- Threat actor: who/what (criminal gangs, APTs, insiders, script kiddies, nature)
- Vulnerability: the weakness (unpatched CVE, weak password, no MFA, human trust)
- Impact: what it costs (money, data, reputation, safety)
Security work = shrinking vulnerabilities and impact faster than threats evolve. You cannot eliminate risk; you manage it to the organization's risk appetite — a business decision, not a technical one. This is why NIST CSF 2.0 added GOVERN as its sixth function.
Pakistan context
PECA 2016 (amended 2025) criminalizes unauthorized access (§3), data copying (§4), interference (§5), and — post-2025 — false information (§26A) and manipulated intimate content (§21). NCCIA enforces; PKCERT coordinates national incident response. Your career sits inside this legal frame — know it cold.