Certified - CompTIA Network +

In Episode One Hundred Thirty-Nine we begin building the foundational mindset that all network security professionals must understand—what we are protecting, and what we are protecting against. Before diving into defensive tools or response plans, we must first identify what security means in practical terms. For network administrators, that foundation is defined by the CIA triad: Confidentiality, Integrity, and Availability. These three principles guide every security decision and serve as the lens through which all threats, vulnerabilities, and mitigation strategies should be viewed.
The purpose of this episode is twofold. First, to clearly explain the CIA triad and why each component is critical to a secure and functional network. And second, to introduce the wide array of network threats that aim to compromise one or more elements of that triad. From malware to social engineering, from protocol exploits to device misconfigurations, threats come in many forms and from many directions. Network Plus candidates must understand how to recognize these threats, how to categorize them, and how each one undermines confidentiality, integrity, or availability.
The CIA triad is the cornerstone of security. It defines the goals of protective measures and the outcomes that threats seek to compromise. The “C” in CIA stands for Confidentiality—ensuring that data is only accessed by authorized individuals or systems. The “I” stands for Integrity—making sure that information remains accurate and unaltered. And the “A” stands for Availability—ensuring systems and data are accessible when they’re needed. When any one of these pillars is violated, the network’s security posture has failed. On the Network Plus exam, the CIA triad appears frequently, often in questions that ask you to map threats or failures to specific components.
Confidentiality is about preventing unauthorized access to information. This could be as simple as requiring login credentials for an admin interface or as complex as encrypting network traffic across multiple segments. Encryption is a major tool for preserving confidentiality—whether encrypting data at rest in storage or encrypting data in transit between endpoints. Access control lists, authentication policies, and physical safeguards also support confidentiality. On the exam, you may be asked to choose which security technologies protect confidentiality and which types of attacks threaten it.
Integrity refers to the accuracy and trustworthiness of data. A system that’s secure but contains altered or corrupted data has lost its integrity. Threats to integrity include unauthorized file modifications, configuration tampering, and man-in-the-middle attacks that alter information in transit. Hashing is a common method used to verify integrity, ensuring that a file or message has not been altered. Digital signatures and checksums also help maintain integrity across systems. Expect exam questions that ask how integrity is enforced and how it can be compromised by attackers or misconfigurations.
Availability is the assurance that systems, services, and data are accessible when needed. Denial-of-service attacks, hardware failures, and software bugs all threaten availability. Availability is protected by designing networks with redundancy, using backup systems, and deploying failover mechanisms. UPS systems, load balancing, and disaster recovery planning are all tools used to maintain availability. On the exam, scenarios involving outages or service disruptions will typically reference the availability aspect of the CIA triad.
Balancing the CIA triad is critical. Focusing too much on one area at the expense of another can reduce overall security. For instance, overly strict access controls might protect confidentiality but hinder availability. Or systems with high uptime may be vulnerable if integrity is not properly checked. Security professionals must make trade-offs thoughtfully, always aiming for a balance that matches the business’s risk tolerance and operational requirements. On the exam, you may be asked to evaluate situations where one aspect of the triad is emphasized too heavily or neglected entirely.
With the CIA triad as a foundation, it becomes easier to understand the types of network threats that exist. A threat is any potential event or actor that could violate confidentiality, integrity, or availability. These threats may come from outside the network—such as attackers on the Internet—or from inside the network, such as a careless or malicious employee. Threats can target systems, users, services, or communication paths. The more aware you are of common threats, the more prepared you are to defend against them. The exam will test your ability to identify and categorize these threats accurately.
Malware is a major threat category that encompasses a variety of malicious software types. Viruses attach themselves to files and spread when the file is executed. Worms self-replicate and spread without user action. Trojans disguise themselves as legitimate software but deliver malicious payloads. Ransomware encrypts data and demands payment for decryption. All of these forms of malware threaten the CIA triad in different ways—ransomware, for instance, directly compromises availability, while Trojans may compromise confidentiality or integrity. On the exam, you’ll be asked to match malware types to their behaviors and triad violations.
Human and social engineering threats target people, not systems. Phishing uses email or messaging to trick users into revealing sensitive data or clicking malicious links. Pretexting involves pretending to be someone trustworthy to gain information. Insider threats occur when employees abuse access rights. Tailgating happens when someone physically follows a legitimate user into a secure area. Impersonation can occur in person or online. These threats are some of the most difficult to defend against because they exploit trust and human error. The exam will test your awareness of these vectors and how they compromise security controls.
Technical threats focus on exploiting vulnerabilities in systems and protocols. Spoofing allows attackers to pose as trusted devices. Sniffing uses packet capture tools to read traffic in transit. Session hijacking and man-in-the-middle, or MITM, attacks let attackers intercept or alter data streams. Denial-of-service and distributed denial-of-service, or DDoS, attacks flood systems with traffic to degrade or eliminate availability. Protocol-level exploits may target outdated versions of services like FTP or SNMP. The exam frequently includes scenarios that involve technical threat vectors and asks you to identify what’s happening and how to respond.
For more cyber-related content and books, please check out cyber author dot me. Also, there are other podcasts on Cybersecurity and more at Bare Metal Cyber dot com.
Exploiting vulnerabilities is one of the most common tactics used by attackers. These vulnerabilities might include weak or default passwords, which allow unauthorized users to gain access. Misconfigured services—such as open ports, disabled encryption, or excessive permissions—create additional exposure. Devices running outdated firmware or unpatched software are especially attractive targets, as known vulnerabilities can be exploited easily. These types of weaknesses are often discovered and attacked automatically by scripts or bots. On the exam, you may be asked to identify examples of exploitable conditions and recommend hardening strategies to close them.
Reconnaissance and scanning are typically the first steps in any cyberattack. During reconnaissance, attackers gather information about the target—IP ranges, device types, operating systems, and open services. Scanning tools are then used to detect live hosts, identify ports, and probe services for weaknesses. This information is used to map the internal network and select vulnerable entry points. While reconnaissance itself may not be harmful, it signals intent and prepares the attacker for more invasive activity. On the exam, you’ll need to recognize how scanning fits into the attack chain and identify countermeasures such as firewalls, IPS systems, or port filtering.
Persistence and lateral movement refer to an attacker’s ability to maintain access and expand control once inside a network. After gaining a foothold—through phishing, credential theft, or an exploited vulnerability—attackers will often plant backdoors or create new user accounts to regain access even if the initial method is discovered. From there, they move laterally, hopping from system to system, often in search of privileged credentials or sensitive data. This movement is typically stealthy, avoiding detection by using legitimate tools and protocols. Expect exam scenarios where you must identify signs of persistent threats or recognize how attackers pivot through a network.
Threats can also be classified by their origin. Internal threats come from within the organization—disgruntled employees, careless users, or contractors with excessive access. External threats come from hackers, cybercriminals, or competitors. Trusted actors are those with legitimate access who may still pose a risk. Untrusted actors are those attempting unauthorized access. Automated threats include bots and scanning tools, while targeted threats involve active human attackers pursuing specific goals. The exam may ask you to classify threats by source, and you’ll need to understand the different motivations and risk levels associated with each category.
The impact of threats on network operations can be severe. Data loss or corruption compromises integrity. Unauthorized access violates confidentiality. Denial-of-service attacks disrupt availability. A single successful attack can result in lost productivity, legal consequences, customer distrust, and financial loss. In regulated industries, data breaches can lead to compliance violations and heavy fines. Network security is not just about protecting systems—it’s about protecting the business. On the exam, expect questions about how specific threats affect operations and which elements of the CIA triad are at risk.
Threat awareness is one of the most effective tools in prevention. Understanding common attack types and recognizing signs of compromise allows teams to respond quickly and reduce damage. This awareness drives proactive configuration—such as disabling unused services, enforcing strong password policies, and enabling logging. It also supports user training programs that reduce susceptibility to social engineering. The more an organization understands the threat landscape, the better it can defend itself. On the exam, you’ll see questions that tie awareness to prevention, especially in scenarios involving user behavior or monitoring responses.
The Network Plus exam places a strong emphasis on threat classification and recognition. You will be expected to identify categories of threats—such as malware, social engineering, or network-based attacks—and match specific examples to them. You’ll also need to recognize which part of the CIA triad each threat compromises. For example, ransomware attacks availability, phishing threatens confidentiality, and configuration tampering damages integrity. Scenario-based questions may combine symptoms and ask you to determine the type of threat, the triad component affected, and the appropriate mitigation step.
In summary, the CIA triad is the foundation upon which all security decisions are made. Confidentiality ensures that only the right people see sensitive data. Integrity makes sure that data is accurate and trustworthy. Availability guarantees that systems and services are accessible when needed. Every threat you encounter—from malware and misconfiguration to phishing and packet sniffing—tries to break one or more of these pillars. Understanding how threats operate and which component they target allows you to plan defenses that are comprehensive, balanced, and effective.
To conclude Episode One Hundred Thirty-Nine, remember that before you can defend a network, you must know what you're protecting and what you're protecting it from. The CIA triad gives you that structure. Threats—whether technical, social, internal, or external—seek to exploit weaknesses in confidentiality, integrity, or availability. By learning to identify and classify these threats, you build the foundation for all other security practices. For the exam and for your future in networking, this knowledge is essential—and it’s where strong security begins.