2.1 The CIA triad2.2 Confidentiality2.2.1 Data protection policy2.2.2 Data at rest2.2.3 Applying encryption2.2.4 Data in transit2.2.5 Encryption prior to transmission2.2.6 Data in use2.2.7 Not so confidential2.2.8 Do I even need this?2.3 Availability2.3.1 DoS and DDoS2.3.2 Accidental outage2.3.3 The role of ransomware2.3.4 Casino betting offline2.3.5 Health organizations are still fair game2.3.6 Building in resiliency2.4 Integrity2.4.1 Integrity starts with access2.4.2 The role of version control2.4.3 Data validation2.4.4 Data replication2.4.5 Data checks2.5 Authentication and authorization2.5.1 Authentication2.5.2 Authorization2.6 Adversaries2.6.1 Script kiddies2.6.2 Insider2.6.3 Cybercriminal2.6.4 Hacktivist and terrorist2.6.5 Advanced persistent threat2.6.6 Why do we care?2.7 Measuring risk2.7.1 Remediate, mitigate, accept2.7.2 Identify the risk2.7.3 Estimating likelihood2.7.4 Estimating impact2.7.5 Risk severity2.7.6 Risk example2.7.7 Other methodologiesSummary