The CIA Triad

The CIA Triad – The Foundation of All Cybersecurity

What does "security" actually mean for a computer system? Cybersecurity professionals use a simple but powerful model to think about security: the CIA Triad. The three letters stand for Confidentiality, Integrity, and Availability. Every security measure you have ever used – from passwords to firewalls to backups – serves one or more of these three goals.

1. Confidentiality – Keeping Secrets Secret

Confidentiality means ensuring that information is accessible only to those authorized to view it.

Everyday analogy: You write a letter, put it in an envelope, and seal it. Only the person you send it to should open it. If someone else opens it, confidentiality is broken.

Common threats:

• Data breaches (hackers steal a database of usernames and passwords).
• Eavesdropping (someone on the same Wi-Fi captures your network traffic).
• Shoulder surfing (someone looks at your screen while you type).
• Insider threats (a disgruntled employee copies customer data).

Defenses: Encryption (at rest and in transit), access controls (passwords, biometrics), multi-factor authentication (MFA), physical security (locked server rooms, privacy screens).

Example: When you visit https://yourbank.com, the padlock icon means your connection is encrypted. A hacker on the same network cannot read your account balance or password.

2. Integrity – Trusting That Data Has Not Been Tampered With

Integrity means ensuring that information is accurate, complete, and has not been altered by unauthorized people.

Everyday analogy: You send a check for $100. If someone intercepts it and changes it to $1000, the integrity of the check is violated.

Common threats:

• Man-in-the-middle attacks (changing data as it travels).
• Malware that modifies system files.
• SQL injection (altering database entries).
• Accidental corruption (hardware errors, software bugs).

Defenses: Hashing (SHA-256 produces a unique fingerprint of a file – if the file changes by even one bit, the hash changes completely), digital signatures, checksums, and access logs.

Example: When you download Linux, the website provides a SHA-256 hash. You run it on your computer. If the hash matches, the file has not been tampered with.

3. Availability – Ensuring Systems Work When You Need Them

Availability means ensuring that information and resources are accessible to authorized users when requested.

Everyday analogy: A library has a book you need. If the library is closed, or the book is lost, or the only copy is checked out – availability is broken.

Common threats:

• Denial-of-Service (DoS) attacks: Flooding a server with fake requests so real users cannot connect.
• Ransomware: Encrypting files and demanding payment to restore access.
• Hardware failures: A hard drive dies, taking the website offline.
• Natural disasters: Fire, flood, or power outage destroys a data center.

Defenses: Redundancy (multiple servers; if one fails, another takes over), backups (the 3-2-1 rule: 3 copies, 2 different media, 1 offsite), disaster recovery plans, and DDoS protection services like Cloudflare.

Example: Netflix uses thousands of servers across the world. If one server in Virginia fails, your request is automatically rerouted to Ohio. You never notice – availability is maintained.

4. The Trade-Offs – You Cannot Maximize All Three

Real-world example: A hospital's electronic health records system needs high availability (doctors cannot wait), integrity (wrong medication would kill), and confidentiality (patient privacy). The hospital invests in all three – it is expensive, but lives depend on it.

5. Beyond the CIA Triad

Security professionals sometimes add more concepts: Authenticity (verifying a message or user is who they claim to be), Non-repudiation (proving a bank transfer was performed by a specific person and they cannot deny it), and Accountability (tracking who did what, when, via audit logs). But for beginners, the CIA Triad is the perfect starting point.

Summary

Review Questions

1. Which CIA pillar is primarily threatened by a DDoS attack?
2. A hacker intercepts a money transfer and changes the destination account number. Which pillar is violated?
3. You use a password manager. Which pillar does this mainly serve?