When people talk about cybersecurity, they often focus on specific technologies such as firewalls, antivirus software, encryption, passwords, intrusion detection and so on.
But before we start talking about how we protect systems, we need to understand what we are trying to protect them from – and what we are trying to achieve.
One of the most fundamental concepts in cybersecurity which helps us do this is the CIA triad.
The CIA triad provides a simple framework for thinking about three fundamental security objectives:
- Confidentiality – preventing information from being accessed by unauthorised people
- Integrity – preventing information from being altered in an unauthorised or inappropriate way
- Availability – ensuring information and systems are accessible when they are needed
Almost every security control an organisation deploys can be related to one or more of these three objectives.
What is the CIA triad?
The CIA triad isn’t a technology, product or security system. It is a security model. It provides a way of considering the three fundamental properties that need to be protected when securing information and information systems.
Think about an organisation’s customer database.
We might want to ensure that:
Confidentiality – Only authorised employees and applications can view the customer information.
Integrity – Nobody can secretly modify customer records.
Availability – The database is accessible when employees and applications need to use it.
If any one of these properties is compromised, there may be a security incident.
For example:
- Someone steals the database → Confidentiality has been compromised
- Someone modifies customer records without authorization to do so → Integrity has been compromised
- Ransomware makes the database inaccessible → Availability has been compromised
The CIA triad therefore gives security teams a simple way of asking:
Can the right people access the right information, is that information trustworthy, and is it available when required?
Confidentiality
Confidentiality is about preventing unauthorised disclosure of information.
In simple terms:
Only the people and systems that are supposed to see information should be able to see it.
This is probably the aspect of cybersecurity that people most immediately associate with security.
Imagine an organisation which holds the following data:
- Customer names and addresses
- Employee salaries
- Medical information
- Passwords
- Credit card information
- Intellectual property
- Business plans
- Authentication credentials
The organisation needs to ensure that this information isn’t disclosed to people who aren’t authorised to access it.
How is confidentiality implemented?
There isn’t a single control that provides confidentiality. Organisations typically use several layers of protection.
Authentication
Before granting access, an organisation needs to establish who or what is requesting access.
Examples of controls used here include:
- Passwords
- Multi-factor authentication
- Smart cards
- Biometrics
- Certificates
- Security keys
Authentication answers the question:
Who are you?
Authorization
Once a user has been authenticated, the organisation needs to determine what they are allowed to access. For example, an employee might be allowed to view customer records but not payroll information.
Authorization answers:
What are you allowed to do?
This is where concepts such as least privilege, role-based access control (RBAC) and access control lists (ACLs) become important. See the post about least privilege for more information.
Encryption
Encryption protects information so that it cannot easily be understood by someone who obtains it without the appropriate key.
It can be used to protect:
- Data stored on disk
- Database contents
- Backups
- Network communications
- Emails
- Files
For example, HTTPS uses encryption to protect information travelling between a browser and a web server.
Data classification
Organisations can also classify information according to its sensitivity.
For example:
Public – This classification could apply to information that can safely be disclosed to anyone.
Internal – This classification could apply to information intended only for employees or authorised users.
Confidential – This classification could be applied to Sensitive business information requiring additional protection, such as payroll data, or employee medical information.
Highly Confidential – This classification could apply to extremely sensitive information requiring the strongest controls. For example, business strategy plans, or employee redundancy plans.
Classification allows an organisation to apply appropriate security controls based on the sensitivity of the information.
Physical security
Confidentiality isn’t limited to computers though. If somebody can walk into a server room and remove a hard drive, the organisation has potentially lost confidentiality regardless of how good its firewall is.
Physical controls such as:
- Locked server rooms
- Access cards
- Security guards
- CCTV
- Secure document disposal
- Visitor controls
can therefore contribute to confidentiality.
Integrity
Integrity is about ensuring that information remains accurate, complete and trustworthy, and that it cannot be changed without authorisation.
In simple terms:
The information should be what we expect it to be.
Consider a bank account. If your account contains £5,000 and an attacker changes the database to show £500, the confidentiality of your account may not have been affected, but the information has nevertheless been compromised because its integrity has been lost.
Integrity has two important aspects.
Data integrity
The information itself hasn’t been improperly modified.
For example:
A customer’s address shouldn’t change unless an authorised process changes it.
System integrity
The systems processing the information haven’t themselves been improperly modified.
For example:
An attacker shouldn’t be able to modify an application so that it secretly sends customer information to them.
How is integrity implemented?
As with confidentiality, organisations use a variety of controls to protect integrity.
Access controls
The simplest approach is to restrict who can modify information.
For example: An employee might be allowed to read customer records but not delete them, whereas another employee might be allowed to modify records.
An administrator might be able to manage the configuration of the database but not approve any financial transactions.
This is where least privilege and separation of duties become particularly important. See the posts about these concepts.
Hashing
A cryptographic hash can be used to detect whether data has changed. A file can be processed through a hashing algorithm to produce a value such as:
5d41402abc4b2a76b9719d911017c592
If the file is subsequently changed, its hash should also change.
Comparing the expected hash with the current hash can therefore indicate that something has been modified and as such whether it can be trusted or not.
It is important to stress that hashing doesn’t prevent modification. Instead, it can provide a mechanism for detecting changes.
Digital signatures
Digital signatures go a step further by allowing an organisation to verify both the integrity and authenticity of information.
They can help answer questions such as:
Has this document been modified?
and:
Did it actually come from the person or organisation that claims to have created it?
Digital signatures are widely used in software distribution, certificates, documents and secure communications.
Logging and auditing
Organisations can also maintain records of changes.
For example:
09:43 — User A changed the customer’s address.
09:47 — User B deleted the customer record.
These logs can help detect unauthorised changes and provide evidence during an investigation.
However, we must also understand that these logs themselves need protection. An attacker who can modify the logs can potentially hide their nefarious activity.
Availability
Availability means ensuring that systems and information are accessible and usable when they are required.
In simple terms:
The system needs to be there when we need it.
A perfectly confidential and completely accurate database isn’t much use if nobody can access it.
Availability is particularly important for organisations that depend on their IT systems to operate.
Consider:
- Online banking
- Emergency services
- Hospitals
- Online retailers
- Manufacturing systems
- Cloud services
- Payment systems
A disruption can have significant financial, operational or even safety consequences.
What can affect availability?
There are many potential causes.
Some are deliberate attacks:
- Distributed denial-of-service attacks
- Ransomware
- Destructive malware
- Sabotage
Others are accidental:
- Hardware failures
- Software bugs
- Configuration errors
- Power failures
- Network failures
- Human error
Natural events can also affect availability:
- Flooding
- Fire
- Storms
- Earthquakes
- Extreme weather
Cybersecurity therefore isn’t simply about stopping hackers. It also involves ensuring that systems can continue operating when something goes wrong.
How is availability implemented?
Redundancy
If an organisation has only one server and it fails, the service may become unavailable. So, to prevent this, an organisation might deploy multiple servers. Now, if one fails, another can continue providing the service.
This is redundancy.
The same principle can be applied across the entire organisation:
- Servers
- Network connections
- Power supplies
- Storage
- Internet connections
- Data centres
- Offices
High availability
Systems can also be designed specifically to minimise downtime.
For example, two servers might operate as a cluster so that if one fails, the other takes over.
This is commonly described as high availability (HA).
Backups
Backups provide a way of recovering information following any number of cyber-related issues:
- Accidental deletion
- Hardware failure
- Ransomware
- Data corruption
- Malicious activity
However, a backup is only useful if it can actually be restored. Organisations should therefore regularly test their backups.
In the same way organisations test their fire alarm systems to ensure they work as expected in the event of a real fire, backup systems must be tested to ensure they work as expected too.
Disaster recovery
Disaster recovery is the process of restoring IT services following a major disruption.
This might involve a number of distinct phases:
- Detecting the incident
- Containing the problem
- Recovering systems
- Restoring data
- Testing the recovered environment
- Returning to normal operation
Disaster recovery is particularly important when an organisation cannot simply restart the affected system.
Business continuity
Business continuity often goes hand-in-hand with disaster recovery but it goes beyond IT.
It asks:
How does the organisation continue operating if something significant goes wrong?
For example:
- If the company’s primary office becomes unavailable, can employees work elsewhere?
- If the main database is offline, can critical business processes continue?
- If a key employee is unable to work, who else can perform their role?
Business continuity therefore considers the organisation as a whole, rather than just its technology.
The three parts are interconnected
One of the most important things to understand about the CIA triad is that confidentiality, integrity and availability aren’t independent. Improving one can sometimes affect another.
The CIA triad is commonly depicted as the diagram below:
In this example, our security objective (e.g. protect data) sits exactly in the middle of the triad – This is not something that works perfectly in the real world. In the real world we might need to make a system more available – this means that the security objective moves more to the availability section and away from the Integrity and Confidentiality sections:
Similarly, if we tighten up on the confidentiality and integrity of a system, it makes it less available.
Security is therefore often about finding the appropriate balance between competing requirements.
The CIA triad in a real organisation
In practice, an organisation doesn’t simply announce that it wants confidentiality, integrity and availability.
It translates those objectives into policies, processes and technical controls.
Consider an organisation storing sensitive customer information.
It might implement the following controls:
| CIA objective | Example controls |
|---|---|
| Confidentiality | MFA, access controls, encryption, data classification |
| Integrity | File integrity monitoring, hashing, digital signatures, audit logs |
| Availability | Backups, redundancy, failover, disaster recovery |
But the controls often overlap. For example, logging can contribute to both integrity and accountability. Access control contributes to confidentiality and integrity, and Backups primarily support availability, but they can also help recover data after an integrity attack such as ransomware or unauthorised modification.
This is why cybersecurity should be thought of as a system of interconnected controls, rather than a collection of individual technologies.
The CIA triad and risk
The CIA triad also provides a useful way of thinking about risk.
Suppose an organisation discovers a vulnerability in its web server. Rather than simply asking “Is this vulnerability dangerous?”, Security teams can ask “What could an attacker do?”
- Perhaps they could steal customer information – That’s primarily a confidentiality concern.
- Perhaps they could modify information – That’s an integrity concern.
- Perhaps they could crash the server – That’s an availability concern.
A single vulnerability can potentially affect all three aspects of the CIA triad
Understanding which security objectives could be affected helps organisations assess the potential impact and decide how the risk should be treated.
The CIA triad isn’t just about cybersecurity
Although the CIA triad is heavily associated with information security, the underlying principles apply much more broadly.
Consider a physical filing cabinet containing confidential employee records.
- Confidentiality – Only authorised employees can access the cabinet.
- Integrity – Records cannot be altered or removed without authorisation.
- Availability – Authorised employees can access the records when they need them.
The same principles apply whether the information is stored:
- On paper
- On a laptop
- In a database
- In the cloud
- On a smartphone
- In an industrial control system
The technology changes – The security objectives don’t.
In summary
The CIA triad consists of:
- Confidentiality: – Protect information from unauthorised access or disclosure.
- Integrity: – Ensure information and systems remain accurate, trustworthy and protected from unauthorised modification.
- Availability: – Ensure information and systems are accessible and usable when required.
The three principles provide the foundation upon which many other cybersecurity concepts are built.