The CIA Triad: Three Words Behind Every Security Decision

The 30-second explanation

Security is really three promises: only the right people can see it, nobody can secretly change it, and it is there when you need it. Break any one and you have a security problem.

How it works

1. 1

   1. Confidentiality

   Only authorised people can read the data.

2. 2

   2. Integrity

   The data cannot be changed without detection.

3. 3

   3. Availability

   Systems and data are there when needed.

4. 4

   4. Balance

   Every control trades between the three.

Confidentiality is about who can see data: encryption and access controls protect it. Integrity is about whether data is trustworthy: hashing, signatures and change logs protect it. Availability is about whether people can use the system: backups, redundancy and DDoS protection protect it. Attacks usually target one leg: data theft hits confidentiality, tampering hits integrity, and ransomware or outages hit availability.

Real-world example

How to spot it

• Data seen by the wrong people

  A confidentiality failure, such as an exposed file share.

• Data that changed unexpectedly

  An integrity failure, such as altered figures or configuration.

• Services that will not respond

  An availability failure, such as an outage or ransomware.

• Controls that hurt usability

  Too much protection can quietly damage availability.

What to do

1. 1When you review a system, ask which of the three properties matters most for it, and protect that first.
2. 2Check that each control has an owner and that you know which property it protects.
3. 3Test availability too: a backup you have never restored is only a hope.