1.3 CIA Triad★★★

# Three Promises Behind One Balance

• Your bank app shows ₹5,000. How do you know that number is true?
• How do you know no stranger is looking at it too?
• And that the app will open tomorrow when you need it?
• All of security rests on these three questions.

# CIA Triad PYQ 5M

The CIA triad is the basic model of information security, made of three goals: confidentiality, integrity and availability, which every system must protect for its data.

Assets, threats and controls

• Asset: anything of value to protect: data, systems, services.
• Threat: anything that can harm an asset (→ 1.4).
• Control: a safeguard that reduces the risk, such as a password, encryption or a backup.

flowchart TD
    C["<b>Confidentiality</b><br>(only the right people)"]:::blue --- I["<b>Integrity</b><br>(correct, unchanged)"]:::green
    C --- A["<b>Availability</b><br>(there when needed)"]:::amber
    I --- A
    classDef blue fill:#5b84d424,stroke:#5b84d480
    classDef green fill:#52a86e24,stroke:#52a86e80
    classDef amber fill:#d6a24424,stroke:#d6a24480

Confidentiality

• Meaning: information is seen only by people who are allowed to see it.
• Threats: eavesdropping on a network, data theft, shoulder surfing, a lost unencrypted laptop.
• How to achieve it:
  1. Encryption of data stored and sent, so stolen data can't be read (→ 6.3).
  2. Access control: each user can open only what the job needs.
  3. Authentication: strong passwords and MFA (password + OTP).
  4. Data classification: label data as public, internal or secret, and protect each level accordingly.
• Example: only you and authorised bank staff can see your account statement.

Integrity

• Meaning: data stays accurate and complete, protected from tampering by unauthorised users.
• Threats: changing amounts or marks, malware that alters files, errors during transfer.
• How to achieve it:
  1. Hashing: a fingerprint of the data; any change gives a different hash (→ 6.5).
  2. Digital signatures: prove who sent the data and that it was not changed.
  3. Checksums to catch errors during transfer.
  4. Access control and version control, so changes are limited and can be traced and undone.
• Example: a ₹500 transfer must reach the other side as ₹500, not ₹5,000.

Availability

• Meaning: information and services are accessible to authorised users when needed.
• Threats: DoS and DDoS attacks (→ 2.17), ransomware, hardware or network failure, power cuts, floods and fires.
• How to achieve it:
  1. Redundancy: spare servers, power supplies and network links.
  2. Backups kept separately and tested (→ 4.11).
  3. Failover to a second data centre when the main one goes down.
  4. DDoS protection, regular patching and maintenance.
• Example: the bank app must work at 11 pm on a holiday, not only in office hours.

Trade-offs

• The three goals pull against each other, so each system needs a balance.
• More locks (extra checks, strict lockouts) protect confidentiality but slow down or block users, which hurts availability.
• More copies (backups, mirror sites) help availability but give attackers more places to steal from.

# Why They Are the Fundamentals PYQ 1M

Confidentiality, integrity, availability (and authenticity) are called the fundamentals because every security goal, attack and control can be traced back to them.

1. Every attack breaks at least one of them, so they show what went wrong.
2. Every control protects at least one of them: encryption for confidentiality, hashing for integrity, backups for availability.
3. They are the yardstick for risk and policy: risk analysis asks what happens if each one fails (→ 4.9), and security policies are written around them (→ 4.8).
4. Standards define security through them: ISO 27001 defines information security as preserving confidentiality, integrity and availability.

Authenticity, non-repudiation and accountability

• Authenticity: the user, message or data is genuine (who it claims to be).
• Non-repudiation: a sender can't later deny sending a message or making a transaction (digital signatures).
• Accountability: every action can be traced to the person who did it (logs, audit trails).
• The Parkerian hexad (Donn Parker, 1998) extends the triad to six: confidentiality, possession, integrity, authenticity, availability, utility.