The CIA triad

Three properties of a useful system

The CIA triad describes confidentiality, integrity, and availability. Confidentiality concerns inappropriate disclosure. Integrity concerns improper changes to information or systems. Availability concerns whether authorized users can obtain the information or service when needed. Together, the three provide a practical starting point for describing security requirements.

These are properties to protect, not three products to purchase. A single control may support several properties, while a poorly designed control can improve one and damage another. The triad helps you explain those effects in ordinary language before discussing technical solutions.

One payroll file, three different failures

Consider a fictional company's payroll spreadsheet. If someone emails it to an unauthorized recipient, employee salary information is disclosed: a confidentiality failure. If someone changes the bank account for an employee without permission, the problem is integrity, even if nobody outside the company reads the file. If the only copy is lost on payday, the immediate problem is availability.

The same incident can affect all three. Malware might steal the spreadsheet, change records, and make the original inaccessible. Labeling the incident with only one word can hide part of its impact. Instead, describe what happened to each property and which people or services were affected.

Translate the goals into requirements

A requirement for confidentiality might state which payroll roles may view salary information. An integrity requirement might specify who can approve bank-detail changes and how those changes are recorded. An availability requirement might state when payroll must run and how quickly the service must recover after an outage.

Those statements are more testable than “keep payroll secure.” They also lead to different evidence. An Access control review checks who can read records. A change-history review checks whether changes were authorized. A recovery exercise checks whether the organization can restore the information in time.

The tradeoff is part of the decision

Imagine a suspicious account is actively changing payroll records. Temporarily suspending access may protect integrity, but it can delay legitimate work. The decision needs an owner, a reason, and a recovery plan. Security teams should explain the expected benefit and operational cost rather than pretending every restriction is free.

Likewise, encrypting the spreadsheet supports confidentiality, but losing its only decryption key can create an availability problem. Cryptography and Disaster recovery therefore connect more closely than their names initially suggest.

Try the model on a familiar service

Choose an online classroom. Write one sentence for each property: who should see private feedback, who may change final grades, and when students need access to course materials. Then describe one failure and one useful control for each.

If your answer says only “use strong passwords,” ask what happens after a successful login, who approves changes, and how the classroom recovers from an outage. The triad is useful because it broadens the question beyond account access while keeping the discussion concrete.