What is the CIA triad?
The CIA triad names the three things security protects: confidentiality (only the right people can see data), integrity (data isn’t changed without permission), and availability (data and systems work when people need them). It’s a widely used model in cybersecurity, and most security controls you’ll run into exist to protect at least one of the three.
This post covers each part and the controls behind it, then walks through a hospital example where all three show up at once, including where they pull against each other.
TLDR
- Confidentiality: keep data private with access controls, encryption, and need-to-know policies.
- Integrity: block or catch unauthorized changes with digital signatures, hashes, and validation.
- Availability: keep systems up with redundancy, backups, and enough capacity.
- Example: how a hospital balances all three.
Confidentiality
Confidentiality means only authorized parties can access information. It protects sensitive data, such as personal information, financial records, and trade secrets.
To achieve confidentiality, organizations use access controls, encryption, and policies and procedures.
🌸👋🏻 Enjoying this post? Get the next issue of [ret]2read. Once a month, I’ll email you whatever’s on my mind, usually Apple security research, offensive security, open source software freedom, and operating system internals.
Access controls
Access controls regulate access to resources, such as data, networks, or systems, so only authorized users can reach sensitive information. Examples include passwords, access cards, and biometric authentication.
Encryption mechanisms
Encryption converts plaintext into ciphertext that unauthorized users can’t read. Only someone with the key can decrypt it. Encryption protects data in transit and at rest, making it harder for attackers to intercept or steal information.
Policies and procedures
Policies and procedures limit sharing to authorized parties on a need-to-know basis. They set clear expectations (often required by law or the organization’s security culture) for employees, contractors, and other stakeholders handling sensitive information. They define who can access which information, what actions are allowed or prohibited, and the consequences of breaking the rules.
Clear guidelines also make security practices consistent, which reduces errors and gaps that can compromise confidentiality.
Integrity
Integrity means data stays accurate and unchanged throughout its lifecycle. Small changes matter in financial systems, medical records, and similar areas. Protecting integrity means preventing unauthorized modification or destruction of data: access controls limit who can modify data, and detection mechanisms catch unauthorized changes.
Want your company or product in front of [ret]2read readers?
One sponsor per issue →
Detection mechanisms
Digital signatures
Digital signatures detect unauthorized changes and prove authenticity. The signer creates a signature with a private key that only they hold. Anyone can verify it with the corresponding public key. A valid signature confirms that the document hasn’t changed since it was signed and that it came from whoever holds the private key.
Checksums
A checksum is a value calculated from the contents of a file or block of data. If the file changes, the checksum almost always changes too, so comparing it to a known value shows whether the file was modified. Simple checksums like CRC32 catch accidental corruption, but an attacker can edit a file and recompute them. To detect tampering, use a cryptographic hash such as SHA-256, and store the known-good value somewhere the attacker can’t change (or sign it).
Data validation
Data validation works earlier: instead of catching changes after the fact, it keeps bad data from getting in. Validation rules check that data is accurate, complete, and in the expected format and range. For example, a numeric field only accepts numbers.
An email field could require an “@” symbol, a valid domain name, and a length within a certain range.
Availability
Availability means authorized people can access data whenever they need it. Downtime costs money and reputation, and in some settings, like hospitals, it threatens public safety. Common threats include hardware failures, power outages, denial-of-service (DoS) attacks, and ransomware, which encrypts data so its owners can’t use it.
Disaster recovery plans, regular backups, and redundant systems prevent disruptions.
Redundancy and backups solve different problems. Redundant systems, like a second server or a failover database, keep critical functions running during a failure. Backups let you restore data after it’s lost or corrupted. Keep at least one backup offline, so ransomware can’t encrypt it too.
Systems also need enough capacity to handle expected workloads without overloading.
The CIA triad at work: a hospital example
A hospital’s patient-record system needs all three parts of the triad:
- Confidentiality: only a patient’s care team can open their chart, records are encrypted at rest and in transit, and staff follow need-to-know rules. In the US, HIPAA’s Security Rule requires safeguards like these.
- Integrity: every chart edit is logged with who made it, medication fields reject impossible doses, and backups are checked against stored hashes.
- Availability: a failover database keeps records up during an outage, and offline backups let the hospital recover from ransomware. Hospitals are frequent ransomware targets because downtime directly affects patient care.
The three also pull against each other. Strict access controls protect confidentiality, but an ER doctor locked out of a chart during an emergency is an availability failure. Many hospitals handle this with “break-the-glass” access: clinicians can open any chart in an emergency, and every use is logged and reviewed later.
Conclusion
The CIA Triad
Each part of the triad needs its own controls, and the parts sometimes conflict, as the hospital example shows. Threats change, so those controls need regular review.
I hope you enjoyed this post on The CIA Triad. If you want to learn more about information assurance, consider reading Changing WordPress Themes: A Security Checkup.
