The Parkerian Hexad: Extending the CIA Triad

As explained in the separate post – The CIA Triad is one of the most fundamental models in cybersecurity.

It asks three questions:

Confidentiality — who should be able to see the information?
Integrity — can we trust that the information hasn’t been altered?
Availability — can we access the information when we need it?

These three principles cover a huge amount of what we need to deal with in information security.

But there are situations where the CIA Triad doesn’t quite tell the whole story though.

Imagine that someone steals a laptop containing a company’s customer database.

The data might still be:

Encrypted
Completely unmodified
Available from a backup

So confidentiality, integrity and availability could all arguably still be maintained.

Yet something important has happened – the organisation has lost possession and control of the information.

This is where the Parkerian Hexad can provide a more complete way of thinking about information security.

What is the Parkerian Hexad?

The Parkerian Hexad is an information-security model developed by security researcher Donn B. Parker in 1998 which expands the three dimensions of the CIA Triad into six:

The six elements are:

Confidentiality
Integrity
Availability
Possession or Control
Authenticity
Utility

The first three are the familiar components of the CIA Triad, and the following three provide additional ways of considering what can go wrong with information.

Possession or Control

The first addition to the CIA Triad is Possession or Control.

This asks the question – Who actually possesses or controls the information?

This is subtly different from confidentiality.

Lets revisit the encrypted laptop scenario. Here the laptop contains sensitive corporate information, and it is stolen by a threat actor.

If the encryption is strong, the attacker might not be able to read the data.

Therefore:

Confidentiality may still be preserved.
Integrity may still be preserved.
Availability may still be preserved through backups.

But the organisation has lost possession of the device and control of the information stored on it.

The attacker may not be able to decrypt the information – but the organisation no longer has physical possession or complete control over the asset.

This distinction can be particularly important for:

Physical devices
Backup media
USB drives
Paper records
Cloud-hosted information
Third-party data processors
Cryptographic keys
Intellectual property

Authenticity

The second addition the Hexad brings is Authenticity.

Authenticity asks the question – Is this information, person, device or message genuinely what it claims to be?

This is related to integrity, but it isn’t exactly the same thing.

Consider an email:

From: ceo@company.example
Subject: Urgent payment

Please transfer £50,000 immediately.

The message might arrive without being altered – Its contents could therefore have perfect integrity.

But what if the sender isn’t actually the CEO of the company?

The information has integrity, but it lacks authenticity.

This distinction is extremely important.

Integrity vs Authenticity

These two concepts are often confused.

A useful way of thinking about them is that Integrity asks – Has the information been changed? whereas Authenticity asks – Is the information genuinely from the claimed source?

Consider a signed document.

If the document is modified after being signed, then the integrity of the document is compromised, and can be checked.

But if an attacker creates a completely new document and successfully makes it appear to have come from your organisation, then the integrity cannot be verified, but importantly, neither can the authenticity.

The two problems are different.

Authenticity in Practice

Authenticity is relevant to much more than messages.

It can apply to:

Users
Devices
Applications
Servers
Software
Digital documents
Messages
Transactions
Websites
APIs

Examples of controls that help establish authenticity include:

Authentication
Digital certificates
Digital signatures
Public-key cryptography
Secure boot
Code signing
Hardware-backed identities
Multi-factor authentication

Utility

The final element of the Parkerian Hexad is Utility.

Utility asks the question – Is the information actually useful for its intended purpose?

This can initially sound very similar to availability.

But there is an important distinction – Information can be available but useless.

Consider a database that is available to users but has been encrypted by ransomware:

The server is running.
Users can connect to it.
The database exists.
But the information has no useful value to them because it cannot be interpreted or used.

Utility has therefore been compromised.

Availability vs Utility

It is important to understand the difference between the two

Availability is – Can I access the information?
Utility is – Can I actually use the information for its intended purpose?

For example, imagine an organisation has an old database containing customer records.

The database is online (It is accessible)

But the organisation has lost the codex required to interpret the database format (it is not useable)

Therefore, the information in the database is available but has lost its utility.

This is particularly relevant when considering:

Obsolete file formats
Legacy systems
Corrupted data
Encrypted data
Missing encryption keys
Incompatible software
Incomplete datasets
Poor data quality

The Six Elements Together

The Parkerian Hexad can therefore be summarised like this:

Element	Key question
Confidentiality	Who can see it?
Integrity	Can I trust that it hasn’t been improperly changed?
Availability	Can I access it when I need it?
Possession / Control	Who currently possesses or controls it?
Authenticity	Is it genuinely what or who it claims to be?
Utility	Is it actually useful for its intended purpose?

Why Does the Parkerian Hexad Matter?

The CIA Triad is deliberately simple, and is one of its greatest strengths. It provides a quick way to think about security without becoming overwhelmed by dozens of different requirements.

However, simplicity can sometimes hide important distinctions.

The Parkerian Hexad encourages us to ask additional questions:

What if someone steals the information but cannot read it?

What if the information is genuine-looking but comes from an attacker?

What if the information is available but cannot actually be used?

These are security problems that aren’t always described neatly by confidentiality, integrity and availability alone.

A Broader View of Information Security

One of the most useful lessons from the Parkerian Hexad is that protecting information isn’t simply about keeping it secret.

Information has other several properties that matter.

It needs to be:

Confidential
Trustworthy
Available
Controlled
Genuine
Useful

If we lose any one of these properties, the value of the information can be affected.

In Summary

The Parkerian Hexad expands the familiar CIA Triad from three security properties to six:

Confidentiality — prevent unauthorised disclosure.
Integrity — maintain accuracy and prevent unauthorised modification.
Availability — ensure information is accessible when required.
Possession / Control — maintain appropriate custody and control of information.
Authenticity — establish that information, users, devices or messages are genuine.
Utility — ensure information remains useful for its intended purpose.

The additional three dimensions are particularly valuable because they highlight situations such as:

Stolen but encrypted data
Genuine-looking but fraudulent information
Accessible but unusable data
Lost control of backup media
Fake software or messages
Data rendered useless by encryption or incompatible formats

The CIA Triad remains an excellent high-level security model, but the Parkerian Hexad simply gives us a larger lens through which to examine information security.

CIA gives us three fundamental questions. The Parkerian Hexad gives us six.

And sometimes those extra three questions reveal the problem that the original three missed.