Confidentiality, Integrity and Availability
The three asks every security decision balances
The CIA triad — confidentiality, integrity, availability — is the security scoreboard every control is measured against. Most security debates are disagreements about which of these to sacrifice to protect another.
What you will learn
- Define confidentiality, integrity and availability with examples
- Classify controls and incidents by which CIA property they touch
- Articulate trade-offs where securing one property weakens another
What is this?
Confidentiality means only authorized parties can read data. Integrity means data is not altered by unauthorized parties or by accidents. Availability means authorized users can access data when they need it. Together they form the CIA triad — the founding framework for assessing threats, controls and incidents in almost every security conversation.
Why do you need it?
- Every incident you'll ever write up is classified as a confidentiality, integrity or availability breach first.
- Controls get chosen against a triad: encryption helps confidentiality, checksums help integrity, redundancy helps availability.
- Trade-offs become visible: locking files down (confidentiality) can create availability pain, and vice versa.
- Compliance audits literally ask 'what is your classification and what triad objectives must hold?'
Mental model
A safe-deposit box, a ledger, and a library's 24/7 door
Confidentiality, integrity, availability
The box seals contents from others (confidentiality). The ledger records every change faithfully (integrity). The library stays open when the patron needs it (availability). A bank needs all three — and spends money keeping each.
How it works
- Confidentiality is implemented with encryption at rest/in transit, access controls and least privilege.
- Integrity is implemented with hashing, digital signatures, audit logs and base-lining of expected values.
- Availability is implemented with redundancy, load balancing, backups, monitoring and patching that avoids downtime.
- An incident touches one or more: a stolen database is confidentiality; tampered financial records are integrity; a DoS is availability.
- Organizations classify data (public/internal/confidential/restricted) to decide how hard to protect each.
The triad with emblematic controls.
In production
- A finance team encrypts the payments DB (confidentiality), signs daily extracts (integrity), and runs the warehouse on a replicated cluster (availability).
- An engineering service adds end-to-end S3 server-side encryption, checksum verification on every download, and a multi-AZ deployment.
- An incident 'authorized user can't reset their password' is triaged as an availability problem — even though the app is confidential and integral.
Best practices
- Classify data before you start protecting it — different classes get different triad emphasis.
- Name the triad objective when reviewing any new control; if it serves none, it's wasted spend.
- Log enough to reconstruct 'who read what, who changed what, when was it down?' — the evidence map of all three.
- Run trade-off reviews: encryption added ≠ availability preserved; test recovery from the encrypted copies.
Common mistakes
- Protecting confidentiality and ignoring integrity — a silent data change is often worse than a leak.
- Buying 'all three' as one tool without verifying each property separately.
- Confusing 'the data exists' (availability) with 'the data is right' (integrity).
- Treating CIA as an engineering slogan instead of the lens that classifies incidents.
Debugging tips
- For 'who changed this?', look at integrity artifact: file hashes, change logs, DB audit triggers.
- For 'who read this?', look at access logs tied to identities and the encryption boundary (was it readable? by whom?).
- For 'why is it down?', separate planned (patch, rebalance) from unplanned (load, failed dependency) availability causes.
Security considerations
- Trade-offs cut both ways: aggressive encryption at rest must still allow authorized recovery (key management is its own risk).
- An integrity-focused audit that blocks writes (fail-closed) can trigger availability degradation — design both consciously.
Interview checkpoint
Quick quiz
A hacker alters product prices in the database. Which triad property was violated?
Availability only matters for public-facing websites.