The CIA Triad: Three Words Behind Every Security Decision

The 30-second explanation

Security really comes down to three promises: only the right people can see something, nobody can quietly change it, and it's there when you need it. Break any one and you have a problem.

How it works

1. 1

   1. Confidentiality

   Only people who are authorised can read the data.

2. 2

   2. Integrity

   The data can't be changed without someone noticing.

3. 3

   3. Availability

   Systems and data stay reachable when needed.

4. 4

   4. Balance

   Every control trades off between the three to some degree.

Confidentiality is about who gets to see data, protected by encryption and access controls. Integrity is about whether that data can be trusted, protected by hashing, digital signatures and change logs. Availability is whether people can use the system when they need to, which is what backups, redundancy and DDoS protection exist for. Most attacks lean on one leg more than the others: theft goes after confidentiality, tampering goes after integrity, ransomware or an outage goes for availability.

Real-world example

How to spot it

• Data seen by the wrong people

  A confidentiality failure, such as a file share left open to more people than it should be.

• Data that changed unexpectedly

  An integrity failure, such as altered figures or a configuration nobody signed off on.

• Services that won't respond

  An availability failure, such as an outage or a ransomware lockout.

• Controls that hurt usability

  Overzealous protection can quietly damage availability by locking out the people who need access.

What to do

1. 1When reviewing a system, ask which of the three properties matters most for it, and protect that first.
2. 2Check that each control has an owner, and that the owner knows which property it's protecting.
3. 3Test availability, not just assume it: a backup you've never restored is only a hope, not a plan.