Security concepts & principles
CIA Triad
Overview
The CIA triad — confidentiality, integrity, and availability — is the core model security professionals use to identify risks and choose appropriate safeguards.
Key concepts
- Confidentiality, integrity, availability
- Matching each property to specific controls
- Seeing all three at work in one real system
How it works
The CIA triad is a core cybersecurity model used to protect information and systems. CIA stands for confidentiality, integrity, and availability — security professionals use the triad to identify risks and choose appropriate safeguards.
| Property | Goal | Example |
|---|---|---|
| Confidentiality | Prevent unauthorized disclosure — only authorized users can access sensitive information (passwords, student records, financial data, health records, trade secrets). | Restricting access to a payroll database to HR staff only. |
| Integrity | Prevent data from being altered, deleted, corrupted, or fabricated without permission. | Verifying a downloaded file's SHA-256 hash against the known-good published hash before trusting it. |
| Availability | Reduce downtime from attacks, hardware failures, outages, or disasters so authorized users can access systems when needed. | Restoring files from backup after a ransomware incident affects a workstation. |
Protecting each part of the triad
- Confidentiality: encryption and MFA.
- Integrity: hashes, logging, and restricted edit permissions.
- Availability: backups, monitoring, and redundant systems.
- Consider all three whenever configuring a new system or handling sensitive data.
Worked example: a school grade portal
A single system can show all three properties at once. A school grade portal protects confidentiality by only letting students, parents, and authorized staff view grades. It protects integrity by restricting who can change grades and logging every change. It protects availability by using backups and reliable servers so the portal stays accessible during report-card periods.