The CIA Triad: What Information Security Protects

When people ask me what I actually do, I sometimes answer with a question: "What are you afraid of losing?" Everything in this post — and in this whole series on the foundations of information security — comes back to the CIA triad.

That's not a deflection. It's the whole job. Information security is not a pile of products — firewalls, antivirus, that dashboard with the red and green dots. It's a discipline for protecting three specific properties of information. Everything else, every control, every policy, every 3 a.m. phone call, is in service of those three. The industry calls them the CIA triad: confidentiality, integrity and availability.

If you understand the triad properly, you can reason about almost any security decision without needing a certification. If you don't, you'll buy tools to solve problems you don't have while the real ones walk in through the front door. So let's take it slowly.

Part 1 of 10 · Foundations of Infosec. Next: Threat Modelling.

Key takeaways

The CIA triad defines the three properties security protects: confidentiality, integrity and availability.
Rate each system on all three separately — they are rarely equal.
The properties pull against each other; most security decisions are trade-offs between them.
Use the triad to find mismatches between what matters and what you actually protect.

Where the CIA triad comes from

The three properties were not invented by a marketing team. They crystallised out of decades of practice, first in military and government computing, then in the commercial world. By the time the ISO/IEC 27000 series formalised the definitions, "preservation of confidentiality, integrity and availability of information" was already the working definition of information security across the field. NIST uses the same three properties as the basis for categorising systems in FIPS 199, which is why US federal systems are rated Low, Moderate or High on each axis separately.

That "separately" matters. A system does not have one security level. It has a confidentiality requirement, an integrity requirement and an availability requirement, and they are frequently different. A public weather site has almost no confidentiality requirement, a modest integrity requirement, and — if farmers or airlines depend on it — a surprisingly high availability requirement. Your payroll system is the opposite shape.

Confidentiality: only the right people can see it

Confidentiality is the property most people picture when they hear "security". It means information is disclosed only to those authorised to see it. A breach of confidentiality is the classic data leak: customer records posted on a forum, a spreadsheet emailed to the wrong person, a laptop left on a train.

The word "authorised" is doing heavy lifting. Confidentiality is not secrecy for its own sake. Your accountant should see the payroll file. The problem arises when the boundary of "should" is fuzzy or unenforced. Most confidentiality failures I've investigated were not clever attacks; they were boundaries that nobody had actually drawn. A shared drive that "everyone in the company" could read, which turned out to include the contractor who left last year and never had their account disabled.

Controls that serve confidentiality include:

Access control — accounts, roles, permissions. The unglamorous core.
Encryption — at rest (disks, databases, backups) and in transit (TLS). Encryption converts a confidentiality problem into a key-management problem, which is usually a better problem to have.
Data classification — knowing which information is sensitive so you can spend effort proportionally.
Minimisation — the cheapest control of all. Data you never collected cannot leak.

A point that's easy to miss: confidentiality also covers metadata. Who talked to whom, when, how often. A hospital's appointment list reveals a great deal even if no diagnosis is attached to it.

Integrity: the information is what it should be

Integrity means information is accurate, complete and has not been altered in an unauthorised way — whether by an attacker, a bug or an accident. It also covers provenance: knowing that a message really came from who it claims to.

Integrity gets less attention than confidentiality because its failures are quieter. Nobody posts "we changed a decimal point in your invoice" on a leak site. But consider what an integrity failure actually looks like:

A supplier's bank details in your accounts system are silently changed, and the next three payments go to a criminal. This is the mechanism behind business email compromise. The FBI's Internet Crime Complaint Center consistently reports it as one of the costliest categories of cybercrime, with billions of dollars in reported losses every year.
A software update is tampered with between the vendor and you. The SolarWinds incident in 2020 was, at its core, an integrity failure in a build pipeline that then propagated to around 18,000 customers who installed a signed, official-looking update.
A database field is corrupted by a bug and the corruption is faithfully backed up for six months before anyone notices.

Controls that serve integrity include hashing and digital signatures, code signing, change management, input validation, database constraints and audit logs. Above all: backups that are tested, versioned and kept somewhere the attacker can't reach.

I'd add one more: separation of duties. The person who can change supplier bank details should not be the same person who approves the payment. That's not a technical control, but it's an integrity control, and it stops a whole class of both fraud and honest mistakes.

Availability: it's there when you need it

Availability means authorised users can access the information and systems when they need to. It's the property that ransomware attacks, denial-of-service attacks, and — far more often — ordinary failures: a full disk, an expired certificate, a botched deployment on a Friday afternoon.

Security teams sometimes treat availability as "the ops team's problem". That's a mistake with real consequences. Ransomware is fundamentally an availability attack; the criminal doesn't need to read your data, they just need you to be unable to. The Verizon Data Breach Investigations Report has tracked ransomware and extortion as a factor in roughly a third of breaches in recent editions. When a hospital diverts ambulances because its systems are encrypted, that is an information security failure in the most literal sense, even though nothing was "stolen".

Controls that serve availability include redundancy, capacity planning, rate limiting, DDoS protection, patching (unpatched systems crash as well as get hacked), monitoring, and above all a rehearsed recovery plan. "We have backups" is not a plan. "We restored the finance system from backup last quarter as a drill and it took four hours" is a plan.

The triad is a set of tensions, not a checklist

Here is the part that turns the triad from a slogan into a tool. The three properties pull against each other. Most real security decisions are about choosing where on that triangle you want to sit.

Confidentiality vs availability. Encrypt a laptop and you protect confidentiality; lose the key and you've destroyed availability. Lock accounts after three failed logins and you frustrate password guessing; you've also handed anyone a way to lock your CEO out by typing their username and mashing the keyboard.
Integrity vs availability. Require every change to go through review and you improve integrity; you also slow down the emergency fix at 2 a.m. Strict database constraints reject bad data — and also reject the slightly-malformed-but-valid data that a partner has been sending for years.
Confidentiality vs integrity. Strong end-to-end encryption protects what's said; it also means your own security tooling can't inspect the traffic for malware.

None of these tensions has a universal answer. The answer depends on what the information is for. This is why security cannot be delegated entirely to a security team: the people who know what a system is for are the people who use it.

When I sit down with a business owner, I don't open with a vulnerability scan. I ask, for each important system: If this leaked, what happens? If this were wrong, what happens? If this were down for a day, what happens? The three answers tell me the shape of the triangle. The shape of the triangle tells me where to spend their money.

Extensions and criticisms

You will hear that the triad is too simple. That's partly fair. Various extensions have been proposed over the years:

Authenticity — being sure a message or entity is genuine. Most people fold this into integrity.
Non-repudiation — a sender can't later deny sending. Important in contracts and payments; served by digital signatures and good logs.
Accountability — actions can be traced to a responsible party.
Privacy — related to confidentiality but broader, and increasingly its own legal discipline.

The "Parkerian Hexad" (Donn Parker, 1998) adds possession, authenticity and utility to the original three. These refinements are useful in specialised contexts. In daily practice, though, I find the original three do almost all the work, precisely because they're few enough to keep in your head during a meeting.

The more serious criticism is that the triad describes properties but says nothing about threats or cost. It tells you what you're protecting, not from whom or at what price. That's true, and it's why the triad is the first foundation rather than the only one. Threat modelling and risk management — which I'll cover in the next posts in this series — sit on top of it.

Using the triad tomorrow morning

If you take one practical thing from this piece, make it this exercise. List the five systems or datasets your business could not function without. For each one, rate confidentiality, integrity and availability as Low, Medium or High, the way FIPS 199 does. Be honest — not everything is High.

Then look at the controls you actually have. You will almost certainly find mismatches: a Low-confidentiality system wrapped in expensive encryption while a High-availability one has no tested backup. That mismatch is your first project, and you found it with three words and a spreadsheet.

Security has a reputation for being impenetrable. It isn't. It's three promises, made about specific things, kept at a price you've chosen consciously. Everything else is implementation detail.

Further reading

ISO/IEC 27000:2018 — Information security management systems — Overview and vocabulary (the definition of information security)
NIST FIPS 199 — Standards for Security Categorization of Federal Information and Information Systems
Verizon, Data Breach Investigations Report (annual)
FBI Internet Crime Complaint Center, Internet Crime Report (annual)
Donn B. Parker, Fighting Computer Crime (1998) — the Parkerian Hexad

This series