CIA Triad
1. Definition
The CIA Triad — Confidentiality, Integrity and Availability — is the fundamental model that defines the goals of information security. Every control, policy and attack can be described in terms of which of these three properties it protects or damages. A fourth, Authenticity (with non-repudiation and accountability), is often added as an extension.
INFORMATION SECURITY
┌─────────────────────────────┐
│ CONFIDENTIALITY │ "only the right people see it"
│ ╱ ╲ │
│ ╱ ╲ │
│ ╱ ╲ │
│ INTEGRITY ─── AVAILABILITY│ "it is correct" / "it is there when needed"
└─────────────────────────────┘
2. Confidentiality
Definition: information is disclosed only to authorised people, processes or devices. The opposite failure is disclosure (a data leak).
| Mechanisms | Threats |
|---|---|
| Encryption (AES for data at rest, TLS for data in transit) | Eavesdropping and packet sniffing on unencrypted links |
| Access control lists, RBAC/ABAC, file permissions | Credential theft through phishing or keyloggers |
| Strong authentication and MFA | Man-in-the-Middle interception |
| Data classification and labelling, need-to-know principle | Insider misuse and social engineering |
| Data Loss Prevention (DLP), watermarking, steganography | Weak encryption, hard-coded keys, exposed backups |
| Privacy policy and law (DPDP Act, GDPR), anonymisation | Shoulder surfing, dumpster diving, lost laptops/USBs |
3. Integrity
Definition: data and systems are accurate, complete and unaltered except by authorised parties. The opposite failure is alteration/tampering — often worse than disclosure, because wrong data silently corrupts decisions.
| Mechanisms | Threats |
|---|---|
| Hashing (SHA-256) and checksums/CRC to detect change | Man-in-the-Middle modification of traffic |
| Message Authentication Codes (HMAC), digital signatures | Malware (viruses, rootkits) altering files or system calls |
| Version control, audit trails, write-once storage | Unauthorised edits by insiders or compromised accounts |
| Input validation, database constraints, referential integrity | Transmission errors and storage corruption |
| Backups and integrity verification of those backups | Ransomware encrypting or corrupting data |
| Blockchain/hash chains for tamper-evident records | Supply-chain tampering of software updates |
4. Availability
Definition: systems, data and services are accessible to authorised users whenever needed. The opposite failure is denial — the service exists but cannot be used.
| Mechanisms | Threats |
|---|---|
| Redundancy — RAID, dual power supplies, clustered servers, multiple ISPs | DoS/DDoS attacks and botnets |
| Backups, replication, disaster-recovery site, tested restore drills | Ransomware (data present but unusable) |
| Load balancing and auto-scaling, DDoS scrubbing/rate limiting | Hardware failure, disk crash, overheating |
| UPS and generators, cooling, physical security | Power outage, natural disasters, fire, flood |
| Patch management and maintenance windows, monitoring/alerting | Misconfiguration, expired certificates, human error |
| Capacity planning to avoid overload | Insider sabotage, cable cuts, cloud-provider outage |
5. Balancing the Three (they pull against each other)
- Confidentiality vs Availability — the strongest encryption and the strictest access control make data harder for legitimate users to reach; a fully air-gapped system is safe but useless for collaboration.
- Integrity vs Availability — checking and re-checking every transaction slows a system down; blocking suspicious traffic (IPS) may block genuine work.
- Confidentiality vs Integrity — a system that allows nobody to write is perfectly integral but useless.
Security is therefore risk-based: classify the asset, weigh the three properties for that asset, and apply proportionate controls. A bank balances all three carefully; a public weather site may accept lower confidentiality to keep availability high.
6. Applications — What the Triad Means in Different Domains
| Domain | Confidentiality | Integrity | Availability |
|---|---|---|---|
| Banking / UPI | Account data, PINs, statements encrypted; MFA | Transactions unalterable; audit trail; no double credit | 24×7 uptime, instant settlement, no downtime at month-end |
| Healthcare | Patient records private (law-protected) | Prescriptions and reports correct, not editable silently | Emergency access to records when the patient arrives |
| e-Commerce | Card/payment data tokenised and encrypted | Orders, prices and payments consistent | Site reachable during a sale; DDoS protection |
| Smart home / IoT | Camera feeds and voice data private | Commands and sensor values not spoofed | Locks and alarms work even if the internet is down |
| Education / exams | Question papers and results confidential | Marks and certificates genuine (digital signatures) | Portal available on result day |
7. Extended Properties and the Opposite Model
- Authenticity — the message really comes from the claimed sender (digital signatures, certificates).
- Non-repudiation — the sender cannot later deny sending it.
- Accountability / auditability — actions can be traced to an identity (logging, AAA).
- Privacy — personal data is used only as consented, and minimised.
- The DAD triad — the attacker's view: Disclosure, Alteration, Denial — the three things an attacker tries to achieve, and names for which pillar each one defeats.
8. Exam Points
- Define the CIA triad and explain each element — 5 marks, almost certain.
- Give two threats and two countermeasures for each of confidentiality, integrity and availability — 5-7 marks, very frequent.
- How do the three properties conflict with each other? Give an example — 5 marks.
- What are authenticity and non-repudiation? Which pillar are they related to? — 3-5 marks.
- Explain the CIA triad with respect to banking / healthcare / e-commerce — 5 marks.
- Which pillar does ransomware mainly attack? What about a DDoS attack? — 3 marks.