When a friend and colleague found himself facing a possible data breach, Jim West, CISSP, SSCP, CGRC, ISSMP, ISSEP, ISSAP, CC, was able to take a look through objective eyes. What unfolded changed how he sees cybersecurity risk.
Disclaimer: The views and opinions expressed in this article belong solely to the author and do not necessarily reflect those of ISC2.
Two large Fortune 500 companies had recently merged. As offices were relocated and operations combined, they experienced a data breach involving sensitive information. The security manager suspected the firewall, so the company brought in a top-tier cybersecurity firm whose firewall specialists performed a focused assessment.
They found no evidence that the sensitive information had been exfiltrated through the network perimeter; their primary finding was that the firewall had not been aligned with the latest CIS Benchmark the company had adopted for secure configuration.
The security manager was a friend and colleague, so out of curiosity I offered to take second look. I came without a product to sell or an answer in mind. I just started asking questions.
At first glance, the firewall finding raised a confidentiality concern. The firewall controlled traffic in and out of the environment, so a configuration weakness naturally raised questions about whether sensitive information had been adequately protected. Then I asked why the secure configuration hadn’t been maintained – and that moved the discussion into integrity. Yes, a secure baseline existed, but the configuration-management process hadn’t kept the firewall aligned with it.
I kept asking why. It transpired that the previous firewall administrator had left several months earlier, but the person who inherited the responsibility hadn’t received all the training, procedures and policy guidance needed to maintain the firewall and enforce compliance.
This personnel shortfall also raised an availability concern: the training, procedures and operational knowledge required to perform the role were unavailable to the replacement administrator when needed, leaving the company without a reliable or sustainable security function.
A single finding had taken me from confidentiality, to integrity, to availability – C to I to A. Yet I still didn’t have an explanation for the breach.
The Question the Firewall Didn’t Answer
It bothered me. The firewall experts had found no evidence of exfiltration through the network perimeter. If the data didn’t leave through the firewall, I needed to stop treating the firewall as the center of the investigation. I recommended that we consider insider threat as the next line of inquiry and, as a consequence, the possibility that information had simply left the company’s control.
A quick walkthrough of the merged offices reinforced that concern. The two companies were still reconciling physical and technical security controls and I saw immediate inconsistencies in monitoring, particularly around printers and scanners. In that environment, someone with legitimate internal access had plausible ways to remove information without creating the kind of network-exfiltration evidence the firewall team had been looking for. Those paths included printing, copying and scan-to-email workflows that had not yet been brought under consistent monitoring.
For clarity: I wasn’t claiming that I knew an insider had caused the breach, only that I had found an additional credible path the original investigation had not considered. The merger had created gaps between two security programs. Those gaps deserved the same scrutiny as the firewall.
Ultimately, I don’t know whether the investigation was able to confirm the source of the breach. But I did see the team reviewing security settings around printers and scanners, and an overall increase in their monitoring of those devices. This didn’t prove how the breach happened, but it did directly address the gaps our walkthrough had exposed.
It was, however, a very memorable point for me: using only the CIA Triad had stopped providing me with enough precision. Confidentiality told me that sensitive information had been exposed. Integrity helped me expose configuration-management weakness. Availability helped me see the loss of trained capability. But none of those labels precisely described the question now in front of me: had the company lost custody or control of its information?
The Principle I’d Been Missing
Later, while studying for the ISSEP and ISSMP certifications, I was introduced to the broader set of nine security principles: confidentiality, integrity, availability, possession, utility, authenticity, non-repudiation, authorized use and privacy.
“Possession” as a security principle immediately gave me a name for the shortfall I had encountered in that merger. Confidentiality still applied, because the information had been disclosed – but that only described the result. Possession described the actual loss of custody or control that was at the center of the question I had been asking.
I’d heard the phrase “security gaps” throughout my career. This experience helped me understand that some gaps were difficult to see because I didn’t yet have the vocabulary to label the security principle at risk. The CIA Triad was fine as far as it went, but sometimes it gave me a lower-resolution view than I needed.
I do think of assessing security risks like image resolution. At a low DPI, I still recognize the picture. At a higher DPI, details that were always present become more visible. Learning the nine principles had the same effect for me: I started seeing finer details and distinctions that I had previously grouped under broader labels.
Possession changed how I thought about data loss prevention. In many environments I’ve worked in, DLP is the first technology mentioned when the conversation turns to keeping information inside the company’s control. I started to treat DLP as one important control measure, rather than proof that the possession problem had been solved altogether. When looking at the entire path around the information – from people, to workflows, printers, scanners, removable media, cloud services – I came to see the other ways information moved.
What Changed in My Assessments
From that point forward, I stopped treating the first visible technical weakness as the whole risk picture, treating it instead as a snapshot. I still started with the CIA Triad, but I kept asking, “What security principle is actually failing here?” I followed the answer through people, processes, technologies and the controls surrounding the finding, to fill in the whole picture.
With hindsight, another real finding from the merger scenario helped reinforce the same lesson. One side of the newly combined company did not have an alternate processing site. While that issue was clearly an availability issue, context matters: after we considered the actual business impact and how the merged environment operated, the gap was assessed as a lower risk and not a high remediation priority. The label identified what was at stake; the surrounding context determined how much it mattered. The higher resolution of the whole security posture didn’t make every finding more severe, but it made the risk conversation more precise.
This would go on to change how I brief leadership. A control number or severity rating rarely tells the complete story. Naming the security principle at risk gave me a clearer bridge from the technical weakness to the mission or business consequence. It enables better communication from the technical concepts to real-world actions they could take.
In the merger’s case, the story was no longer: “The firewall is behind on its secure configuration.” The story was that a breach had occurred during a major transition. The perimeter investigation had not found evidence of network exfiltration. But configuration management and training gaps existed, monitoring was inconsistent across the merged environment and additional paths existed for sensitive information to leave the company’s control. That was a far more useful and actionable risk conversation.
A Higher-Resolution View
I still use the CIA Triad. It remains one of cybersecurity’s most useful foundations and NIST defines information security in terms of confidentiality, integrity and availability. I never abandoned it, but I add resolution and clarity when the work demands it.
Over time, I’ve arranged the nine principles into a visual reference I call the Nine-Point Core Security Principles Star. I began presenting the Nine-Point Star in 2016 as a visualization of how I’ve learned to think through risk, not as a replacement for established frameworks, controls or risk processes.
The lesson from the merger investigation taught me that the most visible control failure isn’t always the one that can explain the incident. While I’d started at the firewall and moved through the CIA triad, it wasn’t until arriving at possession, the security principle that best described the risk I was trying to understand, that we could precisely address the issue.
That’s what higher resolution does for me. The risk is there all along; I just might not be able to see it. The more precisely I can name what’s failing, the easier it is to address the right risk first.
Learn more about ISC2 Security Congress 2026 Sessions
Virtual attendees to Congress can see an on-demand replay of the session this article is linked to as part of their existing access. On-demand access packages for Congress sessions will be available after the event.
Jim West, CISSP, SSCP, CGRC, ISSMP, ISSEP, ISSAP, CC, has 35 years of experience in IT and Cybersecurity. He has held executive, technical management and engineering roles, with responsibility for programs and missions worldwide. His cybersecurity work spans cybersecurity, systems engineering, emerging technologies, education, authorship and global though leadership bridging technical innovation, national security and human empowerment.
