The foundation of cybersecurity
Every security decision - from choosing a password to designing a national defense system - comes back to three principles: Confidentiality, Integrity, and Availability. Together, they form the CIA Triad, the foundation of all information security. If a system protects all three, it’s secure. If any one of them fails, you have a security problem.
The CIA Triad - the three pillars of information security
The CIA Triad is not named after the Central Intelligence Agency. It stands for Confidentiality, Integrity, and Availability. You will see this framework on every cybersecurity certification exam and in every security policy at every organization.
CIA Triad overview from the course slides
Confidentiality
Definition: Only authorized people can access information. Confidentiality is about keeping secrets secret. When you send a private message, only the intended recipient should read it. When a hospital stores your medical records, only your doctor and authorized staff should access them. When a company stores credit card numbers, only the payment processor should see them.The analogy
Think of a locked mailbox. Letters go in, but only you have the key to take them out. Without the lock, anyone walking by could read your mail.Controls that protect confidentiality
Attacks against confidentiality
- Data breaches - Attackers steal databases containing customer records, passwords, or financial data
- Eavesdropping / sniffing - Intercepting network traffic to read unencrypted communications
- Shoulder surfing - Physically looking over someone’s shoulder to see their password or screen
- Unauthorized access - Someone gains access to a system they shouldn’t be able to reach
- Social engineering - Tricking someone into revealing confidential information
Real-world example
Think about your email password. That password keeps your messages confidential. If someone guesses it, steals it, or tricks you into revealing it, they can read every email you have ever sent or received. Every message, every attachment, every conversation - exposed. That’s a confidentiality failure.Integrity
Definition: Data is accurate, complete, and hasn’t been tampered with. Integrity means you can trust that your data is exactly what it’s supposed to be. No one has changed it, deleted parts of it, or added false information. When you check your bank account balance, you trust that the number is correct. When you download a software update, you trust that no one modified it to include malware.The analogy
Think of a wax seal on a letter. In the old days, a letter was sealed with melted wax imprinted with the sender’s ring. If the seal was broken, you knew someone had opened the letter. The seal didn’t prevent anyone from reading the letter - it told you whether the letter had been tampered with.Controls that protect integrity
Attacks against integrity
- Man-in-the-Middle (MitM) attacks - An attacker intercepts communication between two parties and alters the messages
- Data tampering - Modifying records in a database (changing grades, altering financial records)
- SQL injection - Injecting malicious database commands to modify or delete data
- Malware - Some malware modifies files, system configurations, or registry entries
- Bit flipping - Altering individual bits of encrypted data to change the decrypted output
Real-world example
When you download software, the developer often publishes a checksum (like SHA-256) alongside the download link. After downloading, you compute the checksum of your file and compare it to the published value. If they match, the file hasn’t been altered. If they don’t match, someone (or something) modified the file in transit - and you shouldn’t install it.Hashing is a one-way function: you can generate a hash from data, but you can’t reverse the hash back into the original data. Even a tiny change to the input - a single character - produces a completely different hash.
Availability
Definition: Systems and data are accessible when needed by authorized users. Availability means the system is up and running when you need it. Your email works when you need to send a message. The hospital’s patient records are accessible when a doctor needs them in an emergency. The e-commerce site doesn’t crash during a big sale.The analogy
Think of a library. The library has posted hours: 9 AM to 9 PM, Monday through Saturday. During those hours, you expect the doors to be open, the lights to be on, and the books to be on the shelves. If you show up during posted hours and the library is closed, availability has failed.Controls that protect availability
Attacks against availability
- DDoS (Distributed Denial-of-Service) attacks - Flooding a server with so much traffic that legitimate users can’t access it
- Ransomware - Encrypting all of an organization’s files and demanding payment for the decryption key
- Hardware failure - A server hard drive dies, a network switch fails, a power supply burns out
- Natural disasters - Floods, fires, earthquakes, or storms that destroy data centers
- Insider threats - A disgruntled employee deleting critical files or shutting down systems
Real-world example
Every time a major website goes down during a big event - a concert ticket sale, a product launch, a Black Friday deal - that’s an availability failure. The servers couldn’t handle the demand, and legitimate customers couldn’t access the service they needed. Companies invest millions in load balancers, CDNs, and auto-scaling to prevent exactly this scenario.Non-repudiation
Beyond the CIA Triad, there is a closely related concept: non-repudiation. Definition: The sender of a message cannot deny having sent it, and the receiver cannot deny having received it. Non-repudiation provides proof - proof of origin, proof of delivery, and proof of integrity. It prevents someone from doing something and then claiming they didn’t do it.
Non-repudiation prevents denying involvement in a transaction
The analogy
Think of registered mail. When you send a registered letter, the postal service tracks it at every step. The recipient must sign for it upon delivery. After delivery, the sender can’t claim they never sent it, and the recipient can’t claim they never received it. There is a paper trail. Another analogy: a wax seal on a medieval document. The seal proves who sent it (proof of origin), and breaking the seal proves it was opened (proof of receipt and tampering).Controls that provide non-repudiation
How it ties into the CIA Triad
Non-repudiation supports all three pillars:- Confidentiality - Digital signatures confirm that encrypted data came from a trusted source
- Integrity - Signatures prove the data hasn’t been altered since it was signed
- Availability - Audit logs help identify who caused an outage and ensure accountability
Some security frameworks consider non-repudiation a fourth pillar alongside the CIA Triad. Whether you treat it as part of the triad or as a separate concept, the principle is the same: actions must be attributable and undeniable.
Summary: mapping controls to the CIA Triad
This table shows how common security controls map to the three pillars of the CIA Triad. Most controls protect more than one pillar.Think about it: which pillar was violated?
For each scenario below, identify which part of the CIA Triad was violated. Some scenarios involve more than one.1. A hacker steals a database of customer credit card numbers
1. A hacker steals a database of customer credit card numbers
Confidentiality was violated.The data was accessed by someone who was not authorized to see it. The credit card numbers were supposed to be confidential, but the attacker gained access.
2. A student changes their grade in the school's grading system
2. A student changes their grade in the school's grading system
Integrity was violated.The data (the grade) was modified by someone without authorization. The grading system’s records are no longer accurate or trustworthy.
3. A DDoS attack takes an online banking site offline for 6 hours
3. A DDoS attack takes an online banking site offline for 6 hours
Availability was violated.Legitimate customers could not access the banking system during the outage. The service was unavailable when they needed it.
4. An attacker intercepts an email and changes the payment instructions before forwarding it to the recipient
4. An attacker intercepts an email and changes the payment instructions before forwarding it to the recipient
Integrity and Confidentiality were both violated.The attacker read the email (confidentiality breach) and modified its contents (integrity breach). The recipient receives false information and may send payment to the wrong account.
5. Ransomware encrypts all files on a hospital's network and demands payment
5. Ransomware encrypts all files on a hospital's network and demands payment
Availability was violated (primarily), with potential confidentiality impact.Doctors and nurses can’t access patient records, disrupting care. If the attacker also exfiltrated data before encrypting it, confidentiality was breached too - this is called double extortion.
6. A disgruntled employee deletes the company's entire customer database
6. A disgruntled employee deletes the company's entire customer database
Availability and Integrity were both violated.The data is no longer available (availability) and its completeness has been destroyed (integrity). If the company has backups, they can recover - but the original data was compromised.
7. Someone reads your text messages over your shoulder on the subway
7. Someone reads your text messages over your shoulder on the subway
Confidentiality was violated.Your private messages were viewed by an unauthorized person. This is a physical form of eavesdropping called shoulder surfing.