Security — Unseen by Others, Unchanged in Secret, Open When Needed

A Record That Did Not Open for a Month

On October 28, 2020, an employee at a US hospital network opened an email. It was a normal personal email from a real institution, but that institution had already been compromised. The malicious program unleashed after opening the email eventually locked over 1,300 servers so they could not be opened. The attacker left a file with contact information, but did not demand money (DOI: 10.1002/acm2.13422, a case report published in an editorial).

The IT team immediately cut off all network access to protect the main hospital. Thanks to that, they protected other hospitals on the same network, but the main hospital had almost all of its operations halted. Patient records, telephones, the internet, and email could not be used, and the patient record system shared by the entire network was stopped for nearly a month. All patients in the radiation oncology department of this hospital had their treatments delayed for some time (DOI: 10.1002/acm2.13422).

When we hear the word security, we often picture someone secretly stealing a secret. The damage revealed at this hospital was different from that scene. Necessary records could not be opened by the necessary people at the necessary time.

If we examine what we want from the banking apps we use every day, they come down to three things. We want others not to peek at our account details. We want the amount we sent and the recipient not to change along the way. We want the app to open properly on payday morning. This article starts from these three desires and follows the work of deciding what to protect from whom, the places where attacks come in and fixing those places, and what to do when they cannot be blocked completely.

Three Things We Hope for in a Banking App

The three things we hope for in a banking app each have a name. Confidentiality is the property that ensures only authorized people can see that information. If only you and the bank can see your account history, confidentiality is being maintained.

Integrity is the property meaning that information has not been altered without permission, and that if it has been altered, the fact can be detected. If a zero is quietly added to the sent amount or the receiving account is secretly changed, integrity has been broken.

Availability is the property that authorized people can actually use that information and system when needed. What the hospital mentioned earlier lost for nearly a month is availability.

These three are counted as the most fundamental properties of security, and are called the "CIA triad" after their English initials (DOI: 10.1002/9781394207510.ch1). Information must preserve these three properties when it is sent, when it is stored, and when it is processed (DOI: 10.1002/9781118785317.weom070025). This means there are things to protect at the moment messages go back and forth, while they are stored on a mobile phone, and while the app displays those messages on the screen.

Among the three, availability is an important pillar of information security, yet it has been pointed out that it is not treated as seriously when talking about security (DOI: 10.4236/jis.2016.73014). Factors that shake availability exist in software, in hardware, and in networks (DOI: 10.4236/jis.2016.73014). Therefore, the work of protecting availability includes preparing for failures alongside blocking attacks.

Protecting and using pull against each other. The device that decides who can open what must be sturdy, but it must be balanced with keeping work running properly (DOI: 10.1109/access.2025.3533145). If you lock the door with too many layers, it becomes difficult even for the owner to get in.

In addition to the three axes, properties like authentication to check whether the person trying to enter right now is really that person are also commonly requested together (DOI: 10.1002/9781394207510.ch1). Authentication is covered in "Passwords and Passkeys", another piece in this series. Considering that the three axes are not enough to capture everything security practice does, there are also proposals to expand them to six elements by adding the utility of information, whether the source is genuine, and who holds it (DOI: 10.1002/9781118851678.ch3).

The basics that security protects are three: that others cannot see it, that it is not secretly changed, and that it can be used when needed.

What, From Whom, and How Much

Around that time, several hospitals in the United States were attacked in succession. However, the authors of the editorial note that the attacks on the aforementioned hospitals were likely not specifically targeted at those institutions (DOI: 10.1002/acm2.13422). Harm came even though they were not chosen as targets.

A threat is a person or event that can harm at least one of confidentiality, integrity, and availability. There are many threats, including passive ones that merely watch quietly and active ones that directly tamper with things (DOI: 10.1002/9781118785317.weom070025). Threats come from both the outside and inside of an organization. A 2015 encyclopedia entry summarizing information security concludes that research findings support the importance of both internal and external threats, and that in most cases, the damage from threats coming from the inside was the greatest (DOI: 10.1002/9781118785317.weom070025). Here, threats coming from the inside include not only intentional acts but also mistakes.

Since we cannot block all threats equally, we first choose what to protect and against whom. A threat model is a blueprint written in advance detailing what to protect, from whom, and to what extent. Even for the same mobile phone, the doors we need to protect differ when we worry about someone who finds a lost phone versus someone aiming at our email account from afar. In the former case, the device held in the hand is the door; in the latter case, the account beyond the internet is the door.

The thinking of security experts centers on putting themselves in the adversary's shoes. Understanding the adversary, setting goals for protection, finding what they might target, vulnerable spots, and threats, and designing defenses all fall under this (DOI: 10.1080/01611194.2017.1362063, educational case article).

"How much" is also a matter of money and effort. There is an economic model that calculates the most appropriate amount of money to spend on protecting a batch of information (DOI: 10.1145/581271.581274, economic model). In this model, assuming the loss incurred upon a breach is the same, pouring money into the information that is easiest to break into was not necessarily the best choice. Information that is too easy to breach can cost an absurdly large amount of money to protect, so pooling effort into information with a moderate degree of vulnerability could be better. Also, the amount of investment that maximizes returns amounted to only a small fraction of the expected loss upon a breach (DOI: 10.1145/581271.581274). We cannot protect everything with equal firmness, and choosing what to spend and how much on it is the "how much" of threat modeling.

Only by first deciding what to protect, from whom, and to what extent can we determine which lock to put on which door.

Where Attacks Enter

Well-known weak spots in programs usually get public numbers attached, and records pile up in public lists like the United States National Vulnerability Database (DOI: 10.1145/3475960.3475985). A vulnerability is a weak spot in a system that an attacker can dig into to cause something the maker never intended. Up to June 9, 2021, among publicly disclosed records, just the ones tracking fixes gathered across 1,754 open-source projects totaled 5,365 cases. This dataset was built so that newly found or fixed vulnerabilities can be tracked and gathered again (DOI: 10.1145/3475960.3475985). Vulnerabilities are constantly found, and the records of fixes pile up just like this.

One thing tied to vulnerabilities is time. Deadline pressure leads straight to head overload, shortcut judgments, and the result often shows up as unsafe code and half-done security patches. Still, the impact varies depending on the situation, the type of work, and the endurance of the individual and the team (DOI: 10.1002/smr.70147).

People become weak spots too. A significant portion of security incidents happening within organizations stem from digging into people (DOI: 10.1016/j.cose.2021.102267).

One thing that enters through weak spots is harmful programs. Malware is a program built to cause harm behind the user's back. Malware targets confidentiality, integrity, and availability all at once, and persistently threatens both individuals and businesses without discrimination (DOI: 10.3390/app15147747). Locking down 1,300 hospital servers was also malware that rode in through an email (DOI: 10.1002/acm2.13422). The various types of malware and the attacks that trick people into opening the door are covered in another part of this series, "Phishing and Social Engineering".

Many attacks find and enter weak spots, and those spots exist in programs as well as in people.

The Fixed Version and the Gap Between

Phones and computers frequently ask whether you would like to run an update. A patch is a revised edition released to fix vulnerabilities in an already distributed program. The fixes bundled into security updates are patches. Dealing with newly uncovered security issues revolves around an endless stream of patches (DOI: 10.1145/3133956.3134072).

A patch has to be installed to provide protection. Around 2004, self-spreading malware frequently caused massive outbreaks, and even long after patches for those vulnerabilities had been released, those patches failed to act as a first line of defense. Back then, people generally hesitated to install patches immediately, considering them unstable and disruptive to their work. A paper proposing a new defense method around that time described the problem like this (DOI: 10.1145/1015467.1015489, statement of the problem in the proposing paper). There is a gap between the day a fixed version is released and the day it is installed on my device, and during that gap, the already known weak spot remains open.

There is a gap on the other side as well. A zero-day is a vulnerability that has not yet been disclosed and therefore has no fixed version, leaving the defenders with not a single day to prepare. Attackers who discover these weak spots first can strike any organization using that program without getting caught. However, such attacks are rare, and data about them usually only surfaces after an attack is discovered. As a result, it is not well known how long or how commonly such attacks take place (DOI: 10.1145/2382196.2382284).

Delaying updates leaves already fixed weak spots open. Even after completing updates, weak spots that have not yet been disclosed remain, but attacks that exploit such weak spots are rare.

Just Enough Keys, Multiple Layers of Defense

Apps need permission to use sensitive features and information on a phone. A 2011 analysis of 940 Android apps showed that roughly one-third of them requested permissions they did not even use. Developers tried to request only as much as needed, but sometimes failed due to a lack of documentation (DOI: 10.1145/2046707.2046779).

Privilege minimization is a design principle that grants a component only the permissions strictly necessary to finish its assigned task, keeping it from holding the rest at all. It is also called least privilege. Here, a component can be a single app or a single corporate account. If you give someone house-sitting for you only the front door key and not the drawer key, the drawer stays locked even if that key is lost. Smartphones and browsers run each app in a separate, isolated space with restricted permissions (DOI: 10.1109/sp.2012.24).

A single-layer defense fails entirely once that single layer is breached. Defense in depth is an approach that stacks multiple defenses with different characteristics so that if one layer is breached, the next can block or detect it. Ransomware is malicious software that renders files unusable—such as by encrypting them—and then demands money in exchange for releasing them (Phishing and Social Engineering, another piece in this series). There is a paper proposing defense in depth as a way to stop this ransomware. According to this paper, security programs like antivirus software have improved, but that alone is not enough to catch and stop ransomware. Employee training has also become important, but training alone has limits, and human error remains the main entry point for malicious software (DOI: 10.1109/ccwc51732.2021.9375988).

That is why this paper proposes layering security programs, network access controls, dangerous site filtering, email security, backups, and employee training. The authors explain that this makes it possible to catch attacks at multiple points, and leaves a way to restore data without paying a ransom even if an attack succeeds (DOI: 10.1109/ccwc51732.2021.9375988, a proposal paper).

The same idea appears in an old paper addressing medical errors. That paper divides the perspective on errors into two. The person-focused view treats errors as individual problems like carelessness or negligence, and blames and retrains people. The system-focused view assumes that humans are bound to make mistakes and that errors happen even in the best-designed organizations, and builds defenses to prevent errors or reduce their consequences. In the picture drawn by that paper, individual defenses, barriers, and safeguards can each be breached, and an accident happens when a single trajectory pierces straight through those layers (DOI: 10.1136/bmj.320.7237.768, a 2000 paper in medical safety).

Since no single layer is unbreachable, keys are handed out only as needed and defenses are built in multiple layers.

When You Cannot Stop Everything

About five months after the attack in the opening scene, in late March 2021, another American hospital caught malware spreading across its entire network early in the morning. The IT team shut down the hospital servers, and roughly ten office computers were breached in the radiation oncology department alone. Two days later, the treatment record system was restored from a backup made the night before the attack, and patient treatments—about 20 a day—resumed. Other servers took longer to recover because the IT team was short-handed, and in the meantime, setting up a temporary system was thanks to a recent backup that a physicist had kept running separately outside the network; while that temporary system was being put in place, the start of treatment for fewer than ten patients was delayed by two weeks (DOI: 10.1002/acm2.13422).

The previous encyclopedia entry summarizing information security notes that perfect security is desirable, but unfortunately unachievable (DOI: 10.1002/9781118785317.weom070025). That is why security does not stop at blocking. What security does is commonly divided into three things: raising the cost of a breach, noticing when a breach has happened, and recovering after a breach occurs.

Among the techniques for raising the cost is intentionally scrambling programs to make them hard to understand or making them different on every device. What this technique aims for is not eliminating security holes, but making it difficult for an attacker to exploit those holes and succeed in an attack (DOI: 10.1016/j.infsof.2018.07.007). However, because scrambling does not eliminate holes, you cannot rely on it alone, and it amounts to just one extra layer added on top of other defenses. The principle of cryptography, which allows systems to survive even when their method is exposed, is covered in another piece in this series, "Encryption".

Detection devices also have limits. Devices that monitor networks to catch intrusions are widely used, but they carry two limitations: they generate many false alarms and have a low rate of catching zero-day attacks (DOI: 10.1155/2022/9663052). In front of an attack that has slipped past even the detection layer remains the final layer. That is recovery after a breach.

At the heart of recovery is the backup. In a game-theory model dealing with ransomware, the defending side splits its investment between efforts to block attacks and backups. In this model, backups served as a path to recovery and also acted as leverage to drive down ransom demands. However, recovery does not always succeed, and if the cost of recovery was too high, backups were abandoned entirely, leading straight to the worst-case scenario of paying the money. When insurance was introduced, the defending side's efforts decreased, and what decreased was primarily backups (DOI: 10.3390/g14020020, game-theory model).

The authors of the editorial view backups kept isolated from the network as crucial for data that must be protected. While backup systems and automatic failovers have become common, if the entire network comes under attack, those are also highly likely to be knocked out together (DOI: 10.1002/acm2.13422).

Because there is no such thing as perfect security, security extends to raising the cost of a breach, detecting when a breach has occurred, and recovering after a breach.

Tracing That Hospital's Month Again

Now let's return to the hospital from the first scene and trace that month again in the terms of this article.

The threat that struck the hospital was likely not from an opponent who specifically targeted it. The path in was an email opened by an employee, and the organization that sent that email had been breached first. The malicious software that came in through that path locked 1,300 servers (DOI: 10.1002/acm2.13422). In the terms of this article, the damage that appeared first was to availability. Whether information leaked is not stated in that paper.

The IT team immediately cut off all network connections to protect the main hospital, and thanks to that they protected other hospitals on the same network, but the main hospital was left unable to use almost all of its operations (DOI: 10.1002/acm2.13422). In the terms of this article, this was a place where stopping the spread collided with availability.

Bringing it back to life took a long time. Over 5,000 computers were wiped and reinstalled, and servers were rebuilt or verified as clean. It took 9 days for the newly established treatment record system to run on the first treatment equipment, 22 days for it to run on all equipment, and the original system was recovered only about 3 months later (DOI: 10.1002/acm2.13422).

Some data also disappeared at the moment of the attack. Because of that, three patients received treatment either once more or once less than the scheduled number of times, and this fact came to light only after the original system was restored (DOI: 10.1002/acm2.13422). When records disappear, actions that move relying on those records also go awry.

After experiencing such events, the institutions to which the authors of the editorial belong put in place policies such as procedures for restoring systems from clean backups. The authors recommend that organizations should be able to practice the situation of losing systems every year, and should prioritize programs so that they can be restored in order even if hands are short (DOI: 10.1002/acm2.13422).

The weeks and months after the layers of defense were breached were also part of what security does.

Where to Look Next

What encryption, the quintessential tool for preserving confidentiality, hides and fails to hide is covered by another installment in this series, "Encryption". Confirming whether the person trying to enter is truly that person continues in another installment in this series, "Passwords and Passkeys".

Attacks that trick people into opening doors and ransomware are in another installment in this series, "Phishing and Social Engineering". How security and privacy differ is covered by another installment in this series, "Personal Data and Anonymization".

Locks that protect by making the cost of breaking them expensive, and the leaking of keys for those locks, are in "Keys and Locks — Why a Public Key Is Safe to Publish". The second half of integrity, namely devices that make the fact of alteration apparent, leads into the tamper detection covered by "What Is a Blockchain — Why a Ledger With No One in Charge Holds Up".

How the principle of least privilege is used to protect AI agents is in "When Someone Else's Sentence Becomes Your Instruction — Prompt Injection". How unknown vulnerabilities and widened privileges led to actual incidents is followed by "The AI That Hacked to Cheat — Why OpenAI's Agents Broke Into Hugging Face".

Source Papers

• "Introduction to Computer Security" (2024, book chapter) — DOI: 10.1002/9781394207510.ch1 — Three basic security services are called the CIA triad (confidentiality, integrity, and availability), and in addition to these, authentication, authorization, and non-repudiation are commonly required.
• "Information Systems Security" (2015, encyclopedia entry) — DOI: 10.1002/9781118785317.weom070025 — Information security management consists of protecting the CIA triad across three states: transmission, storage, and processing. Perfect security is desirable but unachievable. Both active and passive threats, as well as internal and external threats, are important, and in most cases, the damage from internal threats is the greatest.
• "Information Availability: An Insight into the Most Important Attribute of Information Security" (2016) — DOI: 10.4236/jis.2016.73014 — Availability is a crucial pillar yet is often not treated seriously. Software, hardware, and network factors.
• "A Systematic Review of Access Control Models: Background, Existing Research, and Challenges" (2025, systematic literature review) — DOI: 10.1109/access.2025.3533145 — Strong access control is essential, but it must be balanced with operational efficiency.
• "Toward a New Framework for Information Security?" (2012, book chapter) — DOI: 10.1002/9781118851678.ch3 — Arguing that the CIA triad is insufficient to capture practical realities, proposing six elements (availability, utility, integrity, authenticity, confidentiality, and possession).
• "Are you ready for a cyberattack?" (2021, editorial/case report) — DOI: 10.1002/acm2.13422 — Cyberattack experiences of three organizations. Normal email → encryption of over 1,300 servers, network isolation protecting other hospitals while paralyzing the main campus, record systems down for nearly a month, 9 days, 22 days, and about 3 months, ±1 treatment counts across three patients. Another organization recovered in two days using the previous night's backup. Offline backups are decisive; backup and automatic failover may be unusable during a network-wide attack.
• "Cybersecurity: Exploring core concepts through six scenarios" (2017, educational case) — DOI: 10.1080/01611194.2017.1362063 — Core concepts converge on thinking from the opponent's perspective (understanding the opponent, defining goals, targets, vulnerabilities, threats, risk assessment, and defense design).
• "The economics of information security investment" (2002, economic model) — DOI: 10.1145/581271.581274 — If potential losses are equal, pouring investments into the most vulnerable information is not necessarily optimal. Spending only a small fraction of the expected loss maximizes expected gains.
• "CVEfixes: automated collection of vulnerabilities and their fixes from open-source software" (2021) — DOI: 10.1145/3475960.3475985 — A dataset collecting CVE records from the NVD through to their fixes. 5,365 CVEs across 1,754 projects up to June 9, 2021.
• "A Systematic Review of Time Pressure and Cybersecurity Decision-Making in Software Development" (2026, systematic literature review) — DOI: 10.1002/smr.70147 — Time pressure leads to overload and shortcuts, manifesting as insecure coding and insufficient patches, though the impact varies by context.
• "Enhancing employees information security awareness in private and public organisations: A systematic literature review" (2021, systematic literature review) — DOI: 10.1016/j.cose.2021.102267 — A significant portion of organizational security incidents stems from exploiting the human element.
• "Systematic Review: Malware Detection and Classification in Cybersecurity" (2025, systematic literature review) — DOI: 10.3390/app15147747 — Malware is a persistent threat targeting the CIA triad, impacting both individuals and businesses.
• "A Large-Scale Empirical Study of Security Patches" (2017) — DOI: 10.1145/3133956.3134072 — Endless patching plays a central role in responding to new security issues. Analysis of about 3,000 vulnerabilities and 4,000 fixes across 682 projects.
• "Shield" (2004) — DOI: 10.1145/1015467.1015489 — Even when patches were released long ago, they were not effective as a first line of defense against large-scale worm attacks. People considered patches unstable and disruptive, making them hesitant to install them immediately.
• "Before we knew it" (2012) — DOI: 10.1145/2382196.2382284 — Zero-day attacks exploit undisclosed vulnerabilities, allowing attackers to target anyone undetected. They are rare, and data only emerges after discovery, so their persistence and frequency are not well known.
• "Android permissions demystified" (2011) — DOI: 10.1145/2046707.2046779 — About a third of 940 apps suffered from over-privilege. Developers tried to follow the principle of least privilege but sometimes failed due to a lack of API documentation.
• "User-Driven Access Control: Rethinking Permission Granting in Modern Operating Systems" (2012) — DOI: 10.1109/sp.2012.24 — Modern platforms run each app in an isolated environment with restricted permissions.
• "A Multi-Layered Defense Approach to Safeguard Against Ransomware" (2021, proposal paper) — DOI: 10.1109/ccwc51732.2021.9375988 — Antivirus alone or training alone is not enough, and human error is the primary entry point. Defense-in-depth catches threats at multiple points, enabling recovery without paying a ransom even if an attack succeeds.
• "Human error: models and management" (2000, medical safety) — DOI: 10.1136/bmj.320.7237.768 — The person approach and the system approach. Humans are bound to err, and errors are expected. Defenses, barriers, and safeguards can be breached.
• "Diversification and obfuscation techniques for software security: A systematic literature review" (2018, systematic literature review) — DOI: 10.1016/j.infsof.2018.07.007 — The goal is not to eliminate security holes, but to make it difficult for attackers to exploit them.
• "A Systematic Review on Hybrid Intrusion Detection System" (2022, systematic literature review) — DOI: 10.1155/2022/9663052 — Two limitations of intrusion detection: high false-positive rates and low detection rates for zero-day attacks.
• "Deterrence, Backup, or Insurance: Game-Theoretic Modeling of Ransomware" (2023, game-theoretic model) — DOI: 10.3390/g14020020 — Backups serve both as a recovery tool and leverage to lower the ransom. If recovery costs are high, backups are abandoned, leading directly to payment. Recovery is not guaranteed. Insurance reduces effort and primarily reduces backups.