The CIA Triad

The CIA Triad — Confidentiality, Integrity, Availability — is the foundational model behind every security control ever written.

              ┌────────────────────────┐
              │   CONFIDENTIALITY      │
              │   (only authorised     │
              │    parties read data)  │
              └──────────┬─────────────┘
                         │
        ┌────────────────┴────────────────┐
        │           CIA TRIAD             │
        └────────┬───────────────┬────────┘
                 │               │
    ┌────────────┴─────┐   ┌────┴──────────────┐
    │   INTEGRITY      │   │   AVAILABILITY    │
    │  (no tampering)  │   │  (uptime, access) │
    └──────────────────┘   └───────────────────┘

Only authorised people, systems and processes may read the data.

text
Control       Example
-----------   --------------------------------
Encryption    AES-256-GCM on disk, TLS 1.3
Access ctrl   IAM, file ACLs, network ACLs
Masking       Show last 4 digits of card only

Data must remain correct and un-tampered.

python Run in compiler
import hashlib
with open("invoice.pdf", "rb") as f:
    digest = hashlib.sha256(f.read()).hexdigest()
print(digest)                # store and compare later

Authorised users get access when they need it.

bash
# Availability controls in practice
- redundant power + network
- auto-scaling and load balancers
- DDoS protection (Cloudflare, AWS Shield)
- offline backups for ransomware recovery

"An encrypted backup tape that Bob can read fails Confidentiality even though Integrity and Availability are perfect."

• Spending 80 % of budget on Confidentiality and ignoring Availability.
• Confusing Authenticity (the message really came from Alice) with Integrity.
• Forgetting Non-Repudiation — Alice cannot later deny she sent the message.

Encryption protects C, hashing protects I, redundancy protects A.

1. Every security control should map to at least one pillar.
2. Real attacks usually break more than one pillar — design for all three.
3. Extensions (AAA, Hexad) are useful but never replace CIA.

1. Rate any app you used today 1–5 on each pillar.
2. Draw a CIA diagram for a hospital records system.
3. Find a recent breach in the news and map the failure to a pillar.

1. The CIA Triad is a foundational lens for all security discussions; apply it to every control and threat.
2. Remember that the relative importance of C, I, and A can differ significantly for various data and systems.
3. Availability often gets overlooked, but severe downtime can be as devastating as a data breach.
4. When discussing a control, clearly state which pillar(s) it primarily addresses to show understanding.
5. Recognize that many security controls will often support more than one pillar simultaneously.