The CIA Triad
Three different bad days at Hollow Oak Books: a stranger reads the customer mailing list; someone quietly changes book prices on the website to one penny; the online shop goes down during the holiday rush. All three are security failures, but each breaks something different. The CIA triad gives those three things names.
The rule
Keep data secret, correct and available: confidentiality, integrity, availability.
- Confidentiality — only the right people can see the data. Broken when the mailing list leaks. Protected by permissions, encryption, strong logins.
- Integrity — data is accurate and has not been changed without permission. Broken when prices are altered. Protected by permissions on who may edit, change logs, checksums and backups to restore from.
- Availability — the data and systems work when they are needed. Broken when the shop site is down. Protected by backups, updates, spare capacity and a plan for outages.
(This CIA has nothing to do with any government agency. It is just the initials.)
Not every asset weighs the three equally. For the payroll file, confidentiality matters most. For book prices on the website, integrity: a wrong price costs money on every sale. For the card till on a Saturday, availability: if it stops, the shop stops. Asking which letter matters most for each asset tells you where to spend effort first.
The three pull against each other. Locking a file away with ten passwords is great for confidentiality and terrible for availability. Good security finds the balance that fits what the data is for.
The shortcut
For any incident or any control, ask "Did someone see it, change it, or stop it?" See means confidentiality, change means integrity, stop means availability.
The mailing list leaks
Someone saw data they should not have. Confidentiality.
The trap is thinking security only means secrecy. A backup plan that keeps the shop running is just as much security as a password.
Drills
Answer fast — trust the rule.
A laptop holding customer addresses is stolen and read. Which part of the triad is broken?
A flood of fake traffic makes the shop website unusable for a day. Which part is broken?
An attacker edits an invoice so payment goes to a different bank account. Which part is broken?
Which control mainly protects availability?
Remember
- Keep data secret, correct and available: confidentiality, integrity, availability.
- Ask "Did someone see it, change it, or stop it?"
- Trap: thinking security only means secrecy; the three must be balanced.