Security

Security is the discipline of protecting systems, information, and people from unauthorized access, damage, or disruption. In software engineering it is usually treated as a non-functional requirement and a quality attribute: a condition the system must satisfy, rather than a feature it provides.

The conventional framing is the CIA triad — confidentiality, integrity, and availability. Confidentiality limits who can read data, integrity ensures data and behavior are not altered improperly, and availability ensures the system remains reachable when needed. Most security controls map onto one or more of these axes, and debates about priorities are often debates about which leg of the triad matters most for a given system.

Security is broader than any single mechanism. Technical controls such as authentication, authorization, encryption, and firewalls are the most visible layer. But security also encompasses procedural and operational controls — access policy, patching, audit, and incident response — and the compliance regimes that make those obligations enforceable. Cryptography is the mathematical foundation for much of it, but it is narrower than security as a whole. A system can use strong cryptography and still be insecure if its access controls or operational practices are weak.

Security is often conflated with privacy. The two are distinct. Security protects data from unauthorized access; privacy governs what data is collected, how it is used, and on what basis. Good security is necessary for privacy but not sufficient: a system can be secure and still be invasive.

Because systems will be attacked, modern practice favors secure by design — building security in from the outset rather than retrofitting it after deployment. Effectiveness is verified through security testing and penetration testing, and priorities are informed by community catalogs such as the OWASP Top 10, which enumerate the risks that account for most real-world breaches.

See also