CIA Triad Explained: Confidentiality, Integrity, Availability

Confidentiality

Only the right people can see the data. Everyone else is kept out.

Common controls

encryption passwords MFA access control file permissions

Violated when Someone reads or steals data they shouldn't see. An attacker reads emails over open Wi-Fi. A laptop with customer records is stolen.

Integrity

The data is correct and hasn't been tampered with. What you see is what was actually saved.

Common controls

hashing digital signatures checksums audit logs version control

Violated when Data is changed without permission. A student edits their own grade. An attacker alters a wire-transfer amount in flight.

Availability

The system is up and reachable when you need it.

Common controls

backups redundancy failover DDoS protection UPS / power

Violated when The system is offline when you need it. A DDoS attack knocks a hospital site offline. Ransomware encrypts every file on a city's servers.

All three matter, but not equally. Real systems care about Confidentiality, Integrity, and Availability to different degrees depending on what they do. A bank weights them differently than a public news site. The next tab shows five real contexts and how each one ranks the pillars.