A filing cabinet in a locked room#
Picture one paper medical record in a filing cabinet, in a locked room, in a clinic.
Three separate things can go wrong with it, and they are genuinely different problems:
- The wrong person reads it. A stranger picks the lock and looks at your file.
- Someone changes it. A page is swapped and now your chart says you are not allergic to penicillin.
- Nobody can get to it. The building floods, and your doctor cannot find your history at all.
Those three failures are confidentiality, integrity and availability. The CIA triad is just the observation that security has to defend against all three, and that they are not the same job.
The second one is worth pausing on. A silently altered record can be more dangerous than a stolen one, because nobody knows to stop trusting it.
The three properties, and what serves each#
A control is any safeguard you put in place, technical or otherwise. Each leg of the triad is served by a different family of them:
| Property | The question it answers | Controls that serve it |
|---|---|---|
| Confidentiality | Can only the right people see it? | Encryption, access control lists, least privilege, data classification, physical locks |
| Integrity | Is it still what it was, and can I prove that? | Hashing, digital signatures, checksums, version control, change management |
| Availability | Can the right people get it when they need it? | Redundancy, backups, failover clusters, load balancing, capacity planning, patching |
Two of those are easy to mix up. Encryption protects confidentiality, not integrity. An attacker who cannot read your encrypted file can still corrupt it, and encryption alone will not tell you they did. Detecting the change is a hashing job.
A hash is a fixed-length fingerprint computed from data. Change one character of the data and the fingerprint changes completely, which is why it detects tampering.
Why the three pull against each other#
This is the part that turns the triad from a list into a tool. Strengthening one leg usually weakens another, and exam scenarios are frequently built on exactly that tension.
- Confidentiality against availability. Require a hardware token, a password and a fingerprint to open a file, and you have made it very hard for the wrong person to read. You have also made it harder for the right person, and impossible for anyone who left their token at home.
- Integrity against availability. A change-management process that requires two approvals before any edit protects the record from bad changes. It also means an urgent correction waits for a meeting.
- Availability against confidentiality. Keeping five copies of a database in five locations means an outage cannot destroy it. It also means there are now five places to steal it from.
So security is not "turn everything up". It is deciding which leg matters most for this particular asset. A public price list needs integrity and availability and almost no confidentiality. A list of informants needs confidentiality so badly that losing availability is the safer failure.
What gets added to the triad#
Security+ expects you to know two ideas that sit next to the triad rather than inside it.
Non-repudiation means someone cannot credibly deny having done something. It is a plain-word idea wearing a long word: repudiate means deny, so non-repudiation is "no take-backs". Digital signatures provide it, because only the holder of the private key could have produced the signature. Note that it depends on integrity: proof that Alice signed this document is worthless if the document can be changed afterwards.
AAA is authentication, authorization and accounting, and the three are strictly ordered:
- Authentication asks who are you, and checks the claim.
- Authorization asks what are you allowed to do, once you are known.
- Accounting records what you did, which is what makes the log useful later.
Swapping the first two is a classic exam trap. Proving identity and granting permission are separate steps, and a system can do the first perfectly and the second badly.
How the triad shows up in questions#
Questions rarely say "which leg of the triad". They describe a failure and ask for the best control, and the triad is how you narrow four plausible options to one.
The method is two steps. Name the property that failed, then pick the control family that serves it.
- "An attacker modified transaction records and it went unnoticed for weeks." The failure is integrity, so file integrity monitoring or digital signatures beats stronger encryption.
- "Staff cannot reach the customer portal during the monthly sale." The failure is availability, so load balancing or capacity planning beats stricter access control.
- "A backup tape was lost in transit and it was unencrypted." The failure is confidentiality, so encrypting backups at rest beats adding another backup copy.
That last one is worth reading twice. The scenario is about a backup, and backups feel like an availability topic, so the availability-flavoured answer looks right. The thing that actually went wrong was that a stranger could read the data.
Name the property that failed before you pick a control, because the control family follows from the property and the scenario is usually dressed up as the wrong one.
Test yourself in the free Kestrel Exams app
Topic-selectable practice — offline, no ads, no account.
Practice this topic →Frequently asked questions#
What does CIA stand for in cybersecurity?
Confidentiality, integrity and availability. It has nothing to do with the intelligence agency. Confidentiality means only authorised people can read the data, integrity means the data has not been altered and you can prove it, and availability means the people who need it can reach it when they need it.
Does encryption protect integrity?
No, encryption protects confidentiality. Someone who cannot read an encrypted file can still corrupt or destroy it, and encryption on its own does not tell you that happened. Detecting alteration is the job of hashing, checksums or digital signatures.
Is non-repudiation part of the CIA triad?
No, it sits alongside it. Non-repudiation means a person cannot credibly deny having performed an action, and digital signatures provide it. It depends on integrity, because proving who signed a document means nothing if the document can be altered afterwards.
What is the difference between authentication and authorization?
Authentication establishes who you are and verifies the claim. Authorization decides what you are permitted to do once you are known. They happen in that order, and a system can authenticate perfectly while authorizing badly, which is how an ordinary user account ends up with administrator rights.
Can you have all three properties at maximum?
Not in practice. The three pull against each other, so strengthening one typically weakens another. Requiring three factors to open a file raises confidentiality and lowers availability. The work is deciding which property matters most for a specific asset, not maximising all three.
Something here not clear? A topic you wish we covered? Tell us. We read every message, and a request is the fastest way to get a guide written — several of these exist because somebody asked.