Network Security CIA Triad

The CIA Triad is the foundation of every information security decision. It stands for Confidentiality, Integrity, and Availability. Every security control, policy, and tool serves at least one of these three goals. When a security decision seems complicated, checking it against the CIA Triad usually clarifies the right answer.

           CONFIDENTIALITY
            (Keep it secret)
                /\
               /  \
              /    \
             /      \
     INTEGRITY ───── AVAILABILITY
  (Keep it accurate)  (Keep it accessible)

Confidentiality — Keep Data Secret

Confidentiality means only authorized people can access specific data. A patient's medical records should be readable by doctors and nurses, but not by the hospital's cleaning staff. A company's salary database should be accessible to HR, not to every employee.

How Confidentiality Gets Broken

An attacker who intercepts an unencrypted email reads the contents. An employee who logs into a shared account sees data they should not access. A database misconfigured to allow public access exposes every record to the world.

Controls That Protect Confidentiality

Control               | What It Does
----------------------|---------------------------------------------
Encryption            | Makes data unreadable without the correct key
Access Control Lists  | Defines who can read specific files or systems
Authentication        | Verifies the user's identity before granting access
VPN                   | Encrypts data traveling over public networks
Data Classification   | Labels data so people know how sensitive it is

Integrity — Keep Data Accurate

Integrity means data stays correct and unmodified unless a legitimate, authorized change is made. A bank transfer record must show the exact amount sent. A software update file must not be tampered with between the developer and your computer.

How Integrity Gets Broken

An attacker who intercepts a file transfer changes a number in a financial record. A disgruntled employee deletes database entries. Ransomware encrypts files, making the data inaccessible and effectively corrupted from the organization's point of view.

Controls That Protect Integrity

Control               | What It Does
----------------------|---------------------------------------------
Hashing               | Creates a fingerprint of data; any change changes the hash
Digital Signatures    | Proves data came from a specific source unchanged
Version Control       | Tracks every change made to a file and who made it
Write Protections     | Prevents unauthorized modification of files
Audit Logs            | Records every change so tampering is detectable

Hashing Example

A hash function takes any data and produces a fixed-size "fingerprint." Change one character in the original data and the hash changes completely.

Original file: "Transfer $500 to Account 12345"
Hash:          a3f1c2...8b9d  (64 characters)

Tampered file: "Transfer $5000 to Account 99999"
Hash:          7e2a91...3c14  ← completely different!

Receiver compares hashes → mismatch detected → file rejected

Availability — Keep Systems Accessible

Availability means authorized users can access systems and data when they need to. A hospital's patient record system must be available to nurses at all hours. An e-commerce website must be up during shopping hours or the business loses sales.

How Availability Gets Broken

A DDoS attack floods a web server with so many fake requests that it cannot respond to real users. Ransomware locks all files, making systems unusable. A hardware failure with no backup plan takes systems offline for days.

Controls That Protect Availability

Control               | What It Does
----------------------|---------------------------------------------
Redundancy            | Duplicate systems take over if one fails
Backups               | Copies of data allow recovery after loss
DDoS Protection       | Filters flood traffic before it reaches servers
UPS (Power Backup)    | Keeps servers running during power outages
Load Balancing        | Distributes traffic so no single server gets overwhelmed
Disaster Recovery     | Documented plan to restore systems after a major incident

When CIA Goals Conflict

Security professionals regularly face trade-offs between the three goals:

Scenario                              | Tension
--------------------------------------|-----------------------------------
Heavy encryption on all systems       | Availability ↓ (slower access)
Very strict access controls           | Availability ↓ (people locked out)
Keeping audit logs of everything      | Confidentiality risk (logs hold data)
Encrypting backups tightly            | Availability ↓ (slow recovery time)

A hospital faces a real CIA conflict during emergencies. Maximum confidentiality controls (biometric authentication, two-factor login) slow down nurses who need patient records instantly to save a life. The hospital must balance confidentiality with availability — possibly using a break-glass emergency access procedure that logs the override for audit purposes.

Real-World CIA Failures

Confidentiality Failure

A healthcare company stores patient records on an unencrypted server accessible from the internet. Attackers download millions of records. The breach costs the company tens of millions in fines, lawsuits, and reputation damage.

Integrity Failure

Software update servers get compromised. Attackers replace a legitimate update with malware. Millions of users install the malware because they trust the official update channel — their integrity checks were either absent or bypassed.

Availability Failure

A government website goes down during an election day due to a DDoS attack. Citizens cannot access voter information services. Even if no data is stolen, the attack successfully disrupts the democratic process.

Keeping all three pillars strong at all times is the central challenge of network security. Each pillar demands its own set of controls, and neglecting any one of them creates a gap that attackers actively look for.