The CIA Triad: Confidentiality, Integrity and Availability in Practice

Confidentiality, integrity and availability are the three properties security exists to protect. Every control you will study maps to at least one of them, and the reason the triad is worth more than a definition is that the three pull against each other. Security work is mostly deciding which one wins.

Confidentiality

Only authorized parties can read the data.

The controls that serve it: encryption of data at rest and data in transit; access control and least privilege; strong authentication; data classification, so that protection matches sensitivity; network segmentation; and physical controls, since an unattended screen defeats every cryptographic measure behind it.

Typical failures are unencrypted backups, over-broad file share permissions, a misconfigured cloud storage bucket, and a laptop left in a car.

Integrity

Data is accurate and has not been altered without authorization — including by accident.

Controls: cryptographic hashing to detect change; digital signatures, which prove both integrity and origin; file integrity monitoring; input validation, since most application compromise is a failure to constrain what enters the system; version control and change management; and checksums on transfers.

A distinction that gets tested: hashing detects change; it does not prevent it, and on its own it does not prove who made it. An attacker who alters a file and recomputes its hash has defeated a bare checksum. A signature, or a hash kept somewhere the attacker cannot reach, is what closes that gap.

Integrity also covers the mundane cases — a failing disk corrupting records, a bad import truncating fields, two processes writing at once. Not every integrity failure has an attacker behind it.

Availability

The data and systems are usable when needed.

Controls: redundancy and failover; backups with tested restores; capacity planning; RPO and RTO targets that make the requirement explicit; DDoS protection; patching, because unplanned outages are frequently caused by failures nobody attacked.

Availability is the leg people underrate on exams and overrate in operations. Ransomware is an availability attack first. So is a deleted backup, a full disk, and an expired certificate.

Where the Three Conflict

This is the part that makes the triad useful rather than decorative.

• Confidentiality versus availability. Encrypt everything and lose the key, and the data is perfectly confidential and entirely unavailable. Key escrow exists to resolve this, and creates its own risk.
• Integrity versus availability. A system that halts rather than process a questionable transaction protects integrity at the cost of uptime. Which is correct depends entirely on whether it is a payment system or a status dashboard.
• Confidentiality versus usability. Every additional authentication step reduces the chance of unauthorized access and increases the chance that people route around the control — which is where shadow IT comes from.

Exam scenarios frequently describe an organization prioritizing one leg. A hospital prioritizes availability, because an inaccessible record can kill someone. A bank prioritizes integrity. An intelligence agency prioritizes confidentiality. The "correct" control follows from which leg the scenario cares about.

Beyond the Triad

Non-repudiation — the inability to credibly deny having performed an action. Delivered by digital signatures and reliable logging. It is sometimes described as part of integrity and sometimes as a fourth property; know it either way.

Authentication and authorization are frequently added, giving the AAA framing along with accounting.

The DAD triad — disclosure, alteration, destruction — is the attacker's mirror image and a useful way to remember what each leg protects against.

Exam Focus

Match the control to the leg, because that is the question form. Encryption protects confidentiality. Hashing protects integrity. Redundancy protects availability. Ransomware attacks availability primarily and confidentiality when data is exfiltrated first. Know that non-repudiation requires signatures rather than hashing alone. And when a scenario states a business priority, let that decide which leg the answer should serve.