Security is protection of resources i.e. People, Technology, Information etc. from threat Agent. The resources are vulnerable whether its technology, information, people and threat agent tries to exploit these vulnerability. We need to protect these resources by putting controls on it.
There are various security domains : Physical Security, Information Security, Cryptography, Operation security, Network Security.
I am into Network Security domain since 10 years so can shed some light on it. In Network, Security is all about CIA i.e. Confidentiality, Integrity and Availability. All mitigation controls we put are just to protect our resources and to achieve these three elements. The value of these three elements can vary, depends upon the organization type, information type etc. Lets say, for one organization, It is more important to achieve Confidentiality and Integrity rather than Availability however for other organization, availability can be more important than Integrity or Confidentiality.
However every security domain has its own details and methods to protect the relevant resources.
