DAD Triad

Lesson plan

Level

Beginner

Time

About 60 minutes; the steps below add up to 60

Learners first describe what could go wrong with their phone photos, then see that “hacked” is not enough to act on: each kind of outcome needs a different response. Only then are disclosure, alteration and denial named, one step each, every one opening with a prediction about the error beginners most often make. The worked incident report is split into three short steps: classify, separate the responses, and change one fact. The habit to build: name each observed outcome separately from its suspected cause.

Objectives

• Name the three ways protection of information can fail: disclosure, alteration and denial
• Match each outcome to the CIA objective it undermines
• Tell denial apart from destruction
• Record only the outcomes the evidence shows, separately from the suspected cause
• Explain why restoring data does not undo a disclosure

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the CIA Triad lesson first.
• Have three blank columns on the board for the photo answers. Head them only after the names arrive in the second step.
• The lesson takes about 60 minutes. To teach it in two parts, stop after “Denial or destruction”; the second part opens with the worked example, which uses all three outcomes.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Name the three ways protection of information can fail: disclosure, alteration and denial
   • Match each outcome to the CIA objective it undermines
   • Tell denial apart from destruction
   • Record only the outcomes the evidence shows, separately from the suspected cause
   • Explain why restoring data does not undo a disclosure

   Purpose: Learners first describe what could go wrong with their phone photos, then see that “hacked” is not enough to act on: each kind of outcome needs a different response. Only then are disclosure, alteration and denial named, one step each, every one opening with a prediction about the error beginners most often make. The worked incident report is split into three short steps: classify, separate the responses, and change one fact. The habit to build: name each observed outcome separately from its suspected cause.

2. 1. What actually went wrong? Think 6 min

   Purpose: Find the three kinds of outcome from a familiar situation, and see why one vague word is not enough to act on.

   Ask

   • Three quite different things that could go wrong with your photos?
   • A friend says the photos were hacked. What do you ask first?

   Responses to expect

   • Sort answers into three unnamed columns: seen, changed or spoiled, cannot get at them. Deletion usually comes up; park it for the destruction step.
   • Some ask which phone or app. Steer back to what happened to the photos.
   • On screen in turns: the photos question and its answer, then the hacked-photos question and its answer.

   Misconceptions to challenge

   • A learner may believe: ““Hacked” tells you what happened.” Respond: It names a worry. Ask what happened to the photos: seen, changed or locked away.

   Discussion pause: Collect the photo answers before revealing the first explanation.

   In the lesson window

   • Think it through: Think of the photos on your phone. Describe three quite different things that could go wrong with them.
   • Think it through: A friend messages you: “My photos have been hacked!” Before you can help, what do you need to ask them?

3. 2. The idea Explain 7 min

   Purpose: Name the three outcomes, write the names over the learners' columns, and link each to its CIA objective.

   Ask

   • Which column does the misdirected payroll email go in?

   Responses to expect

   • Some say alteration because the file went somewhere wrong. Ask whether anything in it changed.
   • Diagram: it has the same layout as the exam-results diagram in the CIA lesson. Ask the class to predict which outcome belongs under each objective before revealing.
   • On screen in turns: the plain wording, the three definitions one at a time, the document-service diagram with the DAD outcomes held back, then the outcomes, the payroll question and its answer, then why DAD is not an order of events.

   Misconceptions to challenge

   • A learner may believe: “The three always happen in that order.” Respond: They are separate consequences; the arrows only help memory.

   If the explanation does not land: Pair each word with its plain meaning: disclosure, it leaks; alteration, it is changed; denial, it is blocked.

   In the lesson window

   • Check your understanding: A payroll file is emailed by mistake to someone outside the company. Nothing in the file changes, and staff can still open it. Which outcome is this?

4. 3. Disclosure Predict 4 min

   Purpose: Show that a copy loses confidentiality even when the original is untouched.

   Ask

   • Only copied, ours is unchanged: was anything lost?

   Responses to expect

   • Many say no. Ask who can read it now that could not before.
   • On screen in turns: the copied-file question, its answer, then what counts as disclosure.

   Misconceptions to challenge

   • A learner may believe: “Nothing is lost if the original is still there.” Respond: Ask who can read the information now who could not before.

   In the lesson window

   • Think it through: A colleague says: “The attacker only copied the file. Ours is still there and unchanged, so nothing was lost.” Is that right?

5. 4. Alteration Predict 4 min

   Purpose: Separate improper change from legitimate editing.

   Ask

   • Is the receptionist's correction an alteration?

   Responses to expect

   • “Any change” is the common answer. Ask whether the record became more or less accurate.
   • On screen in turns: the receptionist question, its answer, then what counts as alteration.

   Misconceptions to challenge

   • A learner may believe: “Every edit is an alteration.” Respond: Only an improper or unauthorised change is. An authorised correction restores accuracy.

   In the lesson window

   • Think it through: A receptionist corrects a misspelt name in a patient record, as their job allows. Is that an alteration in the DAD sense?

6. 5. Denial Predict 5 min

   Purpose: Recognise loss of access as a failure in its own right, and record it without assuming a cause.

   Ask

   • Busy service, bookings intact: has protection failed?
   • Which log entry would you write for the school website?

   Responses to expect

   • Some think nothing failed because the data is safe. Ask whether customers can book.
   • “Attacked” is tempting; ask what the evidence actually shows.
   • On screen in turns: the busy-service question, its answer, what counts as denial, then the website-log question and its answer.

   Misconceptions to challenge

   • A learner may believe: “An outage means an attack.” Respond: Faults and failed dependencies stop services too. Record the loss of access; investigate the cause.

   In the lesson window

   • Think it through: An online booking service is so busy that nobody can load it, but every booking in its database is intact. Has protection failed?
   • Check your understanding: A school’s website has been unreachable since 08:00. Which is the better first entry in the incident log?

7. 6. Denial or destruction Predict 5 min

   Purpose: Separate destruction (lost or damaged) from denial (cannot reach), and deal with the other expansion of the final D.

   Ask

   • The only copy of the coursework is deleted: denial, destruction or both?

   Responses to expect

   • Most pick one. Ask the two questions separately: is it lost, and can anyone use it?
   • On screen in turns: the deleted-coursework question, its answer, how denial and destruction differ, then what a recoverable copy changes and the other wording of DAD.

   Misconceptions to challenge

   • A learner may believe: “Denial and destruction are the same thing.” Respond: Contrast the deleted coursework with the busy booking service: one lost the data, the other only blocked it.

   If the explanation does not land: Return to the photos: a phone you cannot unlock, against photos that were deleted.

   In the lesson window

   • Think it through: A teacher deletes, by mistake, the only copy of a class’s coursework file. Now nobody can open it. Is this denial, destruction, or both?

8. 7. A simple example Experiment 7 min

   Purpose: Classify one connected incident into three outcomes, using the worked incident report.

   Ask

   • How many separate problems does the organisation have?

   Responses to expect

   • “One incident” is common. Ask whether a single action would fix all of it.
   • On screen in turns: the scenario and the how-many-problems question, its answer, the table of three consequences, then the incident report with its first step only, each log line classified, what is not established, and the responses with the result.

   Discussion pause: Before each part of the incident report appears, ask the class for the next step: classify the lines, then say what is not established.

   In the lesson window

   • Think it through: Before you read on: how many separate problems does the organisation now have to deal with?

9. 8. Separate the consequences before choosing controls Predict 5 min

   Purpose: Match a response to each consequence, and see that restoring data cannot take back what was read.

   Ask

   • Service back, contract restored: is it over?

   Responses to expect

   • Most say yes. Ask what the attacker still holds.
   • On screen in turns: the is-it-over question, its answer, the controls for the contract being read, being changed and the service going down, one at a time, then why restoration does not undo disclosure.

   Misconceptions to challenge

   • A learner may believe: “Restoring the data ends the incident.” Respond: It repairs integrity and availability; information already read stays read.

   In the lesson window

   • Think it through: In the document-service incident, the service is working again and the contract has been restored from its change history. Is the incident over?

10. 9. Change one fact, change the conclusion Predict 4 min

    Purpose: Record only the outcomes the evidence establishes.

    Ask

    • Only addresses read: what goes in the record?

    Responses to expect

    • Some list all three “to be safe”. Insist on “not established”, which differs from “did not happen”.
    • On screen in turns: the staff-addresses question, its answer, how the conclusion moves with the facts, then how to write it up.

    If the explanation does not land: Change the fact again aloud: what if the only copy had been deleted? Ask which outcomes would then be established.

    In the lesson window

    • Think it through: Change the document-service incident: an attacker reads a file of staff home addresses. Nothing is changed and the system stays up. What should the incident record show as affected?

11. 10. Why it matters Explain 3 min

    Purpose: Place DAD beside the lessons on how attackers get in and how serious a problem is.

    Ask

    • What can DAD not tell you about an incident?

    Responses to expect

    • How the attacker got in, and how serious it is.
    • On screen in turns: what each triad does, why incident labels hide the outcomes, then where the controls are taught.

12. 11. Apply it in a new situation Apply 4 min

    Purpose: Set up independent application, ideally on a later day.

    Ask

    • Who will try these now, and who later in the week?

    Responses to expect

    • The library question checks alteration without disclosure; the ransomware question checks that a label proves nothing on its own.
    • On screen in turns: the library question and its answer, then the ransomware question and its answer.

    In the lesson window

    • Apply it: Someone who should not have access changes a library’s online catalogue so that a book on loan shows as available. Nothing secret was read and the catalogue stays online. Which outcome is this?
    • Apply it: A manager writes: “We were hit by ransomware, so confidentiality, integrity and availability were all affected.” What is the best response?

13. 12. Check your understanding Check 4 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The denial and destruction question links back to the coursework and booking-service contrast.
    • On screen in turns: each revision question and its answer, then where to practise. The questions are interactive: learners choose and check before the explanation opens.

14. 13. What to remember Consolidate 2 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: name the three outcomes and the CIA objective each undermines.

    Responses to expect

    • Disclosure and confidentiality, alteration and integrity, denial and availability.
    • On screen in turns: the summary, the key terms, then the common misunderstandings.

15. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Leaked, changed or blocked: three outcomes, three names.
    • Each outcome is the failure of one CIA objective.
    • Lost or damaged is destruction; unable to reach is denial; one can cause the other.
    • Write down what the evidence shows, apart from the suspected cause.
    • Getting the data back does not take back what an attacker has already read.

Consolidation

• Leaked, changed or blocked: three outcomes, three names.
• Each outcome is the failure of one CIA objective.
• Lost or damaged is destruction; unable to reach is denial; one can cause the other.
• Write down what the evidence shows, apart from the suspected cause.
• Getting the data back does not take back what an attacker has already read.