CIA Triad & Core Security Principles

Table of Contents

1. Introduction to the CIA Triad
2. Why the CIA Triad Matters
3. Confidentiality
4. Integrity
5. Availability
6. CIA Triad in Action — Case Studies
7. Balancing the CIA Triad
8. The AAA Model
9. Authentication
10. Authorization
11. Accountability
12. Non-Repudiation
13. Privacy
14. Other Important Security Principles
15. Putting It All Together
16. Real-World Scenarios

Introduction to the CIA Triad

The CIA Triad is the foundation of all cyber security. Every security practice, tool, and policy you'll ever learn about exists to support one or more of these three principles.

What is the CIA Triad?

C — Confidentiality — "Keep it secret"
I — Integrity      — "Keep it accurate"
A — Availability   — "Keep it accessible"

Where Does the Term Come From?

The CIA Triad has been a core concept in information security since the 1970s. It was formally established as a standard in the NIST (National Institute of Standards and Technology) guidelines and remains the fundamental model for understanding security goals.

Why is it Called a "Triad"?

Because all three principles are equally important and interconnected. If any one is broken, security fails completely:

Simple Analogy: Your Bank Account

Another Analogy: A Library

Why the CIA Triad Matters

Every Security Decision Starts Here

Whether you're:

• Setting a password → You're protecting Confidentiality
• Making a backup → You're ensuring Availability
• Using a checksum → You're verifying Integrity
• Implementing MFA → You're supporting Authentication (related to Confidentiality)

Real-World Impact of Ignoring the CIA Triad

1. Confidentiality

What It Means

Confidentiality ensures that information is not disclosed to unauthorized people, entities, or processes — only the right people can see it.

Deep Dive: How Confidentiality Works

Confidentiality is achieved through a combination of technical and administrative controls:

Confidentiality
├── Encryption
│   ├── At Rest (stored data is encrypted)
│   └── In Transit (data moving across networks is encrypted)
├── Access Controls
│   ├── Discretionary (owner decides)
│   └── Mandatory (system-enforced)
├── Authentication
│   ├── Passwords
│   ├── Biometrics
│   └── MFA
└── Data Classification
    ├── Public
    ├── Internal
    ├── Confidential
    └── Restricted

Methods to Achieve Confidentiality

Real-World Examples

Common Threats to Confidentiality

Remember: Confidentiality = "Only authorized eyes can see this"

2. Integrity

What It Means

Integrity ensures that data is accurate, complete, and has not been tampered with — it remains exactly as it was when created or authorized.

Deep Dive: How Integrity Works

Integrity is about trust. When you receive data, you need to be sure:

1. It came from the claimed source
2. It hasn't been modified in transit
3. It hasn't been altered by unauthorized parties

Methods to Achieve Integrity

Example: How Hashing Works

Original Data: "Hello World"
Hash (SHA-256): a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e

Modified Data: "Hello World!" (added exclamation mark)
Hash (SHA-256): 7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069

→ The hashes are COMPLETELY different! Even a tiny change is detected.

Real-World Examples

Common Threats to Integrity

Remember: Integrity = "This data hasn't been changed by anyone unauthorized"

3. Availability

What It Means

Availability ensures that systems and data are accessible when needed by authorized users — no downtime when you need to work.

Deep Dive: How Availability Works

Availability is often the most visible principle — when systems go down, everyone notices immediately.

Methods to Achieve Availability

Understanding Uptime Percentages

Real-World Examples

Common Threats to Availability

Remember: Availability = "I can access this whenever I need it"

CIA Triad in Action — Case Studies

Case Study 1: Equifax Breach (Confidentiality Failure)

Case Study 2: Stuxnet (Integrity Failure)

Case Study 3: Dyn DNS DDoS (Availability Failure)

Balancing the CIA Triad

The Trade-Off Triangle

In practice, you can't maximize all three equally — there are trade-offs:

        Confidentiality
              │
              │
              ▼
    ◄─────── YOU ───────►
              │
              │
              ▼
        Availability

Examples of Trade-Offs

Real-World Trade-Off Example

Bank Security: A bank could maximize security by locking all customer data in a vault with no network access. But then customers couldn't access their money (confidentiality ✓, availability ✗). So banks must find a balance — strong encryption and MFA (confidentiality) while ensuring 24/7 access (availability).

The AAA Model

Beyond the CIA Triad, there are three additional core principles that form the AAA Model (also called the AAA of security):

How AAA Relates to CIA

The AAA model supports the CIA Triad:

• Authentication supports Confidentiality (only authorized users get access)
• Authorization supports Confidentiality (users can only see what they should)
• Accountability supports Integrity (tracks who changed what)

1. Authentication

What It Means

Authentication verifies that someone is who they claim to be — it's the process of proving your identity.

The Three Factors of Authentication

Levels of Authentication

How MFA Works (Step by Step)

1. User enters username + password
   ↓
2. System verifies password is correct (Something you KNOW)
   ↓
3. System prompts for second factor
   ↓
4. User opens authenticator app → gets 6-digit code
   ↓
5. User enters the code (Something you HAVE)
   ↓
6. ACCESS GRANTED — both factors verified

Why MFA Matters (Statistics)

Types of MFA Methods

2. Authorization

What It Means

Authorization determines what an authenticated user is allowed to do — what resources they can access and what actions they can perform.

Authentication vs Authorization

Authentication: "You are John" (verifies identity)
Authorization:  "You can view reports but not edit them" (defines permissions)

Authentication always comes BEFORE authorization.

Key Authorization Models

Real-World Authorization Example

User logs in (Authentication ✓)
  ↓
System checks: "What is this user's role?"
  ↓
┌──────────────────────────────────────┐
│ Role          │ Can Access           │
├──────────────────────────────────────┤
│ Employee      │ Department files     │
│ Manager       │ Department + Reports │
│ HR            │ Employee records     │
│ IT Admin      │ All systems          │
│ CEO           │ Everything           │
└──────────────────────────────────────┘
  ↓
User sees only what they're authorized to see

The Principle of Least Privilege

"Give a person only the permissions they absolutely need to do their job — nothing more."

Examples:

• A receptionist doesn't need access to the CEO's emails
• A junior developer doesn't need production database access
• A temp worker doesn't need access after their contract ends
• A contractor doesn't need access to internal HR data

3. Accountability

What It Means

Accountability ensures that actions can be traced back to the person who performed them — no anonymous actions.

How Accountability Works

User Action → System Records → Audit Log → Investigation (if needed)
(Who? When? What?)           (Stored securely)  (Trace back to user)

Key Accountability Tools

Real-World Accountability Scenario

A security breach occurs: customer data was exported.

With accountability:

• Audit logs show: "User ID 1542 (Sarah, IT Admin) exported 50,000 records at 2:15 AM"
• Investigation reveals Sarah's account was compromised
• Action taken: Reset password, enhance MFA, review access

Without accountability:

• No one knows who exported the data
• Can't determine the scope of the breach
• Can't prevent it from happening again

Non-Repudiation

What It Means

Non-Repudiation ensures that someone cannot deny having performed an action — it provides cryptographic proof.

How It Differs from Accountability

Methods to Achieve Non-Repudiation

Real-World Examples

Email: You sign an email with your digital signature. Later, you can't claim "I didn't send that" because the signature proves it was you.

E-commerce: You place an order online. Non-repudiation prevents you from claiming "I didn't make that purchase" — the digital receipt proves the transaction.

Contracts: E-signatures on legal documents provide non-repudiation — signers can't deny signing.

Privacy

What It Means

Privacy is about controlling how your personal information is collected, used, shared, and stored.

Privacy vs Confidentiality

Examples to Clarify

Key Privacy Principles (GDPR)

Other Important Security Principles

1. Defense in Depth

Don't rely on a single security measure — use multiple layers. (Covered in Tutorial 6)

2. Least Privilege

Give users only the minimum access they need. (Covered in Tutorial 6)

3. Fail Secure

When a system fails, it should fail in a secure state:

• ✅ If a firewall crashes, it blocks ALL traffic (secure failure)
• ❌ If a firewall crashes, it allows ALL traffic (insecure failure)

4. Separation of Duties

No single person should have too much power:

• One person requests a payment, another approves it
• A developer writes code, a different person deploys it

5. Economy of Mechanism

Keep security mechanisms as simple as possible — simpler systems are easier to verify and less likely to have hidden flaws.

6. Open Design

Security should not depend on secrecy of the design — algorithms should be public, keys should be secret (Kerckhoffs's Principle).

Putting It All Together

How All Principles Work Together in Daily Life

You wake up and check your email:

  1. AUTHENTICATION → You enter your password (prove who you are)
  2. AUTHORIZATION → System checks you have permission to access email
  3. CONFIDENTIALITY → Your emails are encrypted during transmission (HTTPS)
  4. INTEGRITY → Your emails haven't been modified by anyone in transit
  5. AVAILABILITY → Gmail servers are up and running (99.9%+ uptime)
  6. ACCOUNTABILITY → All login attempts and actions are logged
  7. NON-REPUDIATION → Sent emails are digitally signed (proves you sent them)
  8. PRIVACY → Google doesn't share your email content without permission (GDPR)

The Full Security Principles Pyramid

              ┌─────────────┐
              │   PRIVACY   │  (Your rights over data)
              ├─────────────┤
              │NON-REPUDIAT.│  (Can't deny actions)
              ├─────────────┤
              │ACCOUNTABIL. │  (Track who did what)
              ├─────────────┤
              │AUTHORIZAT.  │  (What you can access)
              ├─────────────┤
              │AUTHENTICAT. │  (Prove who you are)
              ├─────────────┤
              │AVAILABILITY │  (Systems accessible when needed)
              ├─────────────┤
              │  INTEGRITY  │  (Data is accurate & untampered)
              ├─────────────┤
              │CONFIDENTIAL.│  (Data is private & secure)
              └─────────────┘

Real-World Scenarios

Scenario 1: Online Shopping (Amazon)

Scenario 2: Hospital Emergency Room

Scenario 3: Online Banking