Organizational
Confidentiality, Integrity & Availability
The CIA Triad
Confidentiality
Protecting information from unauthorized access and disclosure
Integrity
Ensuring accuracy and trustworthiness of data and systems
Availability
Guaranteeing timely, reliable access for authorized users
Foundations of the CIA Triad
Introduction to the CIA Triad
Every security control I have ever signed off on, and every risk I have ever had to formally accept, came down to three letters. Confidentiality, Integrity, and Availability are not an academic model you memorize for an exam — in a working security program they are the scoring rubric behind every decision: which risks you fix, which you accept, and which ones keep you up at night. After nearly three decades running and authorizing security programs in federal environments, I can tell you the triad is less a definition to recite than a lens you learn to think in. This reference explains what each pillar means and how they fit together — and, just as important, where I have watched good programs get the balance wrong.
What Is the CIA Triad?
The CIA Triad is the foundational model of information security. It defines the three core properties that all security programs, policies, controls, and technologies are ultimately designed to protect. Every security threat, every vulnerability, every control, and every compliance requirement maps to one or more of these three properties:
C Confidentiality — The privacy and secrecy of information
Confidentiality ensures that information is accessible only to those who are authorized to access it. It protects data from unauthorized disclosure — whether by external attackers stealing data, insiders leaking it, or systems inadvertently exposing it. When confidentiality is breached, private information becomes available to parties who should not have it.
I Integrity — The accuracy and trustworthiness of information
Integrity ensures that information is accurate, complete, and has not been altered by unauthorized parties. It protects data from unauthorized modification — whether by attackers tampering with records, malware corrupting files, or system errors introducing inconsistencies. When integrity is breached, the information can no longer be trusted.
A Availability — The accessibility of information when needed
Availability ensures that information and systems are accessible and functional when authorized users need them. It protects against denial of service — whether by attackers disrupting systems, ransomware encrypting data, hardware failures, or capacity limitations. When availability is breached, authorized users cannot perform their work.
From the Field — A Practitioner’s Take
In most programs I have seen, Confidentiality gets nearly all the attention — encryption, access control, data-loss prevention — because a breach of confidentiality is the one that makes the news. Integrity and Availability quietly get shortchanged.
But ask an operations team which failure actually took the mission down, and it is almost never the leaked document. It is the system that was unavailable the moment it was needed, or the data that was silently wrong and trusted anyway. As an ISSM, my hardest risk conversations were never about Confidentiality; they were convincing leadership that an Availability or Integrity gap deserved the same urgency as a data-exposure finding.
The practical test: if your control set is 90% about keeping secrets and 10% about keeping systems trustworthy and available, you have a blind spot — and attackers, bad configurations, and plain bad luck all find blind spots.
Origins and Evolution of the CIA Triad
The CIA Triad has served as the cornerstone of information security since the late 1970s. Its origins are traced to U.S. government computer security research, with formal articulation in documents such as the Rand Corporation’s R-609 report (1970) — often considered the first document to broaden the scope of computer security beyond physical protection.
While the triad’s simplicity is its greatest strength — providing a universal framework applicable to any system, any industry, and any threat — modern information security has expanded around it. Today, the triad serves as the non-negotiable core while additional properties (authenticity, non-repudiation, accountability, possession, utility) address gaps the original three did not fully capture.
Why the CIA Triad Matters for Every Employee
| CIA Property | Everyday Employee Scenario | Poor Decision & Consequence |
|---|---|---|
| C Confidentiality | Receiving an email requesting you forward customer account details to a new vendor contact | Forwarding data without verifying the request — data breach exposing customer PII; GDPR penalty; reputational damage |
| I Integrity | Discovering an error in a financial report just before the CEO presents to the board | Correcting the file without telling anyone it was changed — loss of audit trail; potential fraud allegation; SOX compliance failure |
| A Availability | A critical business system is slow and you keep restarting it to try to fix it | Masking symptoms of a ransomware encryption process that you’ve now given more time to spread — extended outage and wider damage |
| All Three | Finding a USB drive in the parking lot and plugging it in to find the owner | Introducing malware that exfiltrates data (C), corrupts files (I), and encrypts systems (A) — complete CIA compromise from a single action |
CIA as the Basis of All Security Decisions
- Risk Assessment: Every risk is evaluated by its potential to violate C, I, or A — and the business impact of that violation
- Control Selection: Controls are selected because they protect one or more CIA properties against a specific threat
- Incident Classification: Incidents are classified by which CIA properties they threaten and the severity of that threat
- Compliance Requirements: Every regulatory requirement maps to one or more CIA properties — HIPAA protects C and I of PHI; PCI DSS protects C of cardholder data; HIPAA availability requirements protect A of healthcare records
- Security Architecture: Systems are designed to balance all three properties — a design that maximizes confidentiality at the expense of availability is incomplete
Confidentiality
Defining Confidentiality
Confidentiality is the property that ensures information is not made available or disclosed to unauthorized individuals, entities, or processes. It is the security property most directly associated with privacy — protecting the secrecy of sensitive information from parties who should not access it.
Confidentiality violations range from a low-severity incident (an employee inadvertently CC’ing the wrong person on an email) to catastrophic events (a nation-state actor exfiltrating years of intellectual property). The harm from confidentiality loss is often irreversible — unlike availability violations, you cannot ‘un-disclose’ information once it has been seen by an unauthorized party.
Key Insight
Confidentiality loss is permanent. When an attacker exfiltrates a database of 10 million customer records, restoring the database does not undo the breach. The information is permanently compromised. This irreversibility makes confidentiality protection the highest-stakes dimension of information security — prevention is the only truly effective strategy.
What Confidentiality Protects
| Data Category | Examples & Confidentiality Requirement |
|---|---|
| Personally Identifiable Information (PII) | Full name + address; Social Security Number; date of birth; biometric data; financial account numbers; IP address (in many jurisdictions). Protected by GDPR, CCPA, HIPAA, state breach laws. |
| Protected Health Information (PHI) | Medical records; diagnosis codes; prescription history; mental health records; any health data linked to an individual. Protected by HIPAA Privacy and Security Rules. |
| Financial & Payment Data | Credit/debit card numbers; bank account details; investment portfolios; salary information; tax records. Protected by PCI DSS, GLBA, SOX, and state financial laws. |
| Intellectual Property (IP) | Trade secrets; product designs; source code; research data; formulas; customer lists; business strategies. Protected by trade secret law, NDAs, and security policy. |
| Authentication Credentials | Passwords; private keys; API tokens; certificates; biometric templates. Loss enables unauthorized access to all systems protected by those credentials. |
| Business-Sensitive Information | M&A plans; board meeting minutes; financial forecasts; legal strategy; employee performance records; competitive analysis. Material non-public information under securities law. |
| National Security & Classified Data | Government classified information; intelligence data; defense capabilities. Protected by classification frameworks (TOP SECRET, SECRET, CONFIDENTIAL). |
Threats to Confidentiality
| Threat Category | Attack Mechanism | Real-World Example |
|---|---|---|
| Data Exfiltration / Breach | Attacker extracts data from compromised systems and transfers it outside the organization via network channels, cloud uploads, or physical media | MOVEit Transfer zero-day (2023): Cl0p ransomware group exfiltrated data from 2,700+ organizations using a single SQL injection vulnerability in a file transfer product |
| Eavesdropping / Interception | Attacker intercepts data in transit — unencrypted network traffic, weak TLS configurations, or compromised intermediary systems | Public Wi-Fi interception of unencrypted HTTP traffic; SSL stripping attacks downgrading HTTPS to HTTP; rogue certificate authority attacks |
| Insider Threat | Authorized user intentionally or accidentally discloses sensitive information — deliberate theft, unauthorized sharing, or inadequate handling | Edward Snowden (2013): authorized user with privileged access exfiltrated classified NSA documents; 50,000+ files disclosed. Cost to trust in government: incalculable. |
| Social Engineering / Phishing | Manipulation of authorized users into disclosing credentials or sensitive data — impersonation, pretexting, or deceptive requests | Business Email Compromise (BEC): attackers impersonate executives to trick employees into wiring funds or emailing sensitive files; $2.9B in losses reported to the FBI IC3 in 2023 |
| Misconfiguration / Exposure | Sensitive data inadvertently exposed through misconfigured storage, permissions, or access controls — no attacker action required | Exposed AWS S3 buckets: Capital One (2019) — 106 million customer records exposed due to misconfigured WAF and overly permissive IAM role; $80M civil penalty from the OCC |
| Credential Theft | Attackers obtain valid credentials through phishing, malware, or breach databases — use legitimate access for unauthorized data collection | Snowflake cloud platform compromise (2024): stolen credentials used to access Ticketmaster, Santander, AT&T, and 160+ other customers’ data warehouses; 560M Ticketmaster records exfiltrated |
| Physical Access | Unauthorized physical access to devices, storage media, or facilities containing sensitive data — stolen laptops, non-shredded documents, unlocked workstations | VA laptop theft (2006): unencrypted laptop containing 26.5 million veterans’ PII stolen from employee’s home; largest government data breach at the time |
Confidentiality Controls
| Control Type | Control | How It Protects Confidentiality |
|---|---|---|
| Technical | Encryption (Data at Rest) | Renders data unreadable to unauthorized parties even if they obtain physical or logical access — AES-256 for stored data; database TDE; full disk encryption (BitLocker, FileVault) |
| Technical | Encryption (Data in Transit) | Protects data from interception during network transmission — TLS 1.2+ for all web/API traffic; encrypted email (S/MIME, TLS); VPN for remote access; mTLS for service-to-service |
| Technical | Access Control & IAM | Restricts data access to authorized users only — role-based access control (RBAC); attribute-based access control (ABAC); need-to-know principle; least privilege enforcement |
| Technical | Multi-Factor Authentication | Prevents credential theft from being sufficient for unauthorized access — FIDO2 hardware keys; TOTP authenticator apps; phishing-resistant MFA for privileged accounts |
| Technical | Data Loss Prevention (DLP) | Detects and blocks unauthorized data transmission — content inspection on outbound email, web uploads, USB transfers; policy-based blocking of sensitive data movement |
| Technical | Data Masking / Tokenization | Substitutes sensitive data with non-sensitive placeholders for use in non-production environments or by users who need to work with data but not its exact values |
| Administrative | Data Classification Policy | Assigns sensitivity labels (Public, Internal, Confidential, Top Secret) that drive handling requirements, access controls, and retention policies for all organizational data |
| Administrative | Need-to-Know Enforcement | Access to sensitive information granted only when there is a clear business requirement — not based on organizational seniority or convenience; reviewed regularly |
| Administrative | NDA & Confidentiality Agreements | Legal instruments requiring employees, contractors, and partners to maintain the confidentiality of organizational information — enforceable protection for trade secrets and sensitive data |
| Physical | Screen Locks & Clean Desk Policy | Prevents visual eavesdropping and unauthorized access to unlocked workstations — automatic screen lock after inactivity; no sensitive materials left visible at unattended workstations |
| Physical | Secure Disposal | Ensures data cannot be recovered from disposed equipment — NIST 800-88 media sanitization; DoD 5220.22-M wiping; physical shredding; certificate of destruction for sensitive media |
Integrity
Defining Integrity
Integrity is the property that ensures information is accurate, complete, consistent, and has not been modified by unauthorized parties or processes. It protects both the correctness of the data itself (data integrity) and the proper functioning of the systems that process it (system integrity).
Integrity violations are often the most insidious form of security breach — unlike a confidentiality breach (you know data was stolen) or an availability breach (systems are visibly down), integrity violations may go undetected for months or years. Decisions made on corrupted data, financial records tampered with incrementally, or medical records modified silently can cause profound harm long before anyone realizes the data cannot be trusted.
The Danger of Undetected Integrity Loss
In 2010, the Stuxnet worm attacked Iranian nuclear centrifuges by making them spin at destructive speeds while falsely reporting normal operation to monitoring systems. Engineers saw normal readings while machines were being destroyed. This is the essence of an integrity attack: the victim trusts information that has been secretly corrupted. Undetected integrity loss is more dangerous than detected availability loss.
Dimensions of Integrity
| Integrity Dimension | Definition | Security Requirement |
|---|---|---|
| Data Integrity | Data has not been altered, added to, or deleted by unauthorized parties or processes since its creation or last authorized modification | Cryptographic hashing (SHA-256) to detect modification; digital signatures; database transaction logs; version control; audit trails |
| System Integrity | Systems operate as intended, have not been modified by unauthorized parties, and are free from unauthorized code or configuration changes | File integrity monitoring (FIM); code signing; configuration baselines; change management; application whitelisting |
| Transmission Integrity | Data received is identical to data sent — it has not been modified in transit by network errors or active man-in-the-middle attacks | HTTPS/TLS (provides both integrity and confidentiality); digital signatures on transmitted documents; HMAC verification; certificate pinning |
| Non-Repudiation | Actions performed on data can be attributed to specific parties who cannot later deny performing those actions | Digital signatures tied to identity; audit logs with timestamps; certificate-based authentication; multi-party authorization for critical actions |
| Source Integrity / Authenticity | Data originates from the claimed source and has not been fabricated or forged | Digital signatures; PKI certificate chains; DKIM/SPF/DMARC for email source verification; code signing certificates |
Threats to Integrity
| Threat Category | Attack Mechanism | Real-World Example |
|---|---|---|
| Malware / Ransomware | Malicious code modifies, encrypts, or destroys data on compromised systems — often affecting thousands of files within minutes | NotPetya (2017): disguised as ransomware but was pure integrity/availability attack — permanently destroyed MBR and file system; caused an estimated $10B+ in global damage (U.S. government estimate); Maersk lost 45,000 PCs |
| Man-in-the-Middle (MitM) Attack | Attacker intercepts communications and modifies data in transit before forwarding to intended recipient — receiver believes data is authentic | BGP hijacking attacks where routing tables are modified to redirect traffic through attacker-controlled infrastructure — can modify unencrypted content in transit |
| SQL Injection / Database Tampering | Attacker manipulates database queries to insert, modify, or delete records — can alter financial data, user privileges, or audit logs | Multiple banking fraud cases where SQL injection was used to modify account balances or transaction records before proper controls were implemented |
| Insider Data Manipulation | Authorized user deliberately modifies data for personal gain, malice, or to cover fraudulent activity — audit trail manipulation is a key indicator | Nick Leeson (Barings Bank, 1995): manipulated trading records to hide £827M in losses — an integrity failure enabled by poor segregation of duties and inadequate audit controls |
| Supply Chain Compromise | Attacker compromises software update mechanism to inject malicious code into legitimate software distributed to customers | SolarWinds Orion (2020): attackers modified legitimate build process to inject SUNBURST backdoor into update packages; 18,000 organizations installed compromised update |
| Hardware Tampering | Physical modification of hardware to alter its behavior — firmware modification, hardware implants, or counterfeit components | Bloomberg ‘Big Hack’ reporting (disputed): allegations of hardware implants in server motherboards designed to exfiltrate data and alter system behavior |
| Configuration Drift | Unauthorized or undocumented changes to system configurations over time — deviations from security baselines that may introduce vulnerabilities or alter expected system behavior | Configuration drift in cloud environments commonly leads to security control gaps — security groups opening progressively over time as developers make ‘temporary’ exceptions |
Integrity Controls
| Control Type | Control | How It Protects Integrity |
|---|---|---|
| Technical | Cryptographic Hashing | Creates a fixed-size ‘fingerprint’ of data — any modification to the data produces a completely different hash value, making tampering immediately detectable. SHA-256 is the current standard minimum. |
| Technical | Digital Signatures | Combines hashing with public-key cryptography — provides both integrity (tampering detection) and authentication (origin verification). Essential for code signing, document signing, and email authentication. |
| Technical | File Integrity Monitoring (FIM) | Continuously monitors critical system files, configurations, and logs for unauthorized changes — alerts on any modification to protected files. Required by PCI DSS (Requirement 10.3.4) and SOX. |
| Technical | Database Transaction Logging | Records every database operation with timestamp, user identity, and before/after values — enables detection of unauthorized modifications and reconstruction of data history for forensic purposes |
| Technical | Version Control / Immutable Logs | Append-only logging systems (WORM storage, blockchain-based audit trails) prevent modification or deletion of records after creation — provides tamper-evident audit trail for compliance and forensics |
| Technical | Input Validation | Validates all data inputs against expected format, type, length, and content before processing — prevents injection attacks and data corruption from malformed inputs at the application layer |
| Administrative | Change Management Process | Requires formal approval, documentation, and testing for all changes to production systems — prevents unauthorized or undocumented changes that could compromise system integrity or introduce vulnerabilities |
| Administrative | Segregation of Duties (SoD) | Requires multiple people to complete sensitive processes — no single person can create and approve a transaction, modify financial records and approve the audit, or have both development and production deployment access |
| Administrative | Four-Eyes Principle | Critical actions require approval or review by a second authorized party before execution — prevents insider manipulation of sensitive processes and provides mutual accountability |
| Physical | Tamper-Evident Seals | Physical seals on hardware, storage media, and network equipment that visually indicate if tampering has occurred — used for servers, network devices, and evidence storage in high-security environments |
Availability
Defining Availability
Availability is the property that ensures information systems, data, and services are accessible and operational when authorized users need them. It encompasses both the technical reliability of systems (uptime) and the organizational capability to maintain or rapidly restore service in the face of disruptions — whether from attacks, failures, or natural events.
Availability is often undervalued relative to confidentiality and integrity — until an organization experiences downtime. A hospital system that cannot access patient records during surgery, a bank that cannot process transactions during peak hours, or a manufacturer whose production line is offline for days due to ransomware — these availability failures directly threaten lives and organizations in ways that no abstraction captures.
Availability Is a Business Property
Availability is not merely a technical metric — it is a direct business requirement. Every organization has services that, if unavailable, immediately generate financial loss, regulatory exposure, or physical harm. Availability requirements must be driven by business stakeholders who understand the cost of downtime, not just technical teams who define uptime as a service goal.
Measuring Availability — Key Metrics
| Metric | Definition | Operational Significance |
|---|---|---|
| Uptime / SLA (%) | Percentage of time a system is operational — expressed as ‘9s’: 99.9% (8.7 hrs/yr downtime), 99.99% (52 min/yr), 99.999% (5 min/yr) | SLA targets must be defined per system based on business criticality — a 99.9% SLA is unacceptable for a payment system but appropriate for an internal wiki |
| RTO (Recovery Time Objective) | Maximum acceptable time from disruption to service restoration — the availability promise to the business | RTO drives backup strategy, DR architecture, and failover investment — a 1-hour RTO requires active-active or hot standby infrastructure; a 24-hour RTO allows cold standby |
| RPO (Recovery Point Objective) | Maximum acceptable data loss measured in time — how old can restored data be? | RPO drives backup frequency — a 4-hour RPO requires backups at least every 4 hours; a 15-minute RPO requires continuous replication or journaling |
| MTD (Maximum Tolerable Downtime) | Absolute business limit beyond which recovery is impossible — the organization cannot survive longer disruption | MTD must be defined by business owners, not IT — it represents the point at which the business has suffered irreversible harm (customer defection, regulatory action, financial collapse) |
| MTBF (Mean Time Between Failures) | Average time a system operates between failures — measures reliability of hardware and infrastructure | Used to assess reliability of critical components and plan proactive replacement — a MTBF of 100,000 hours means expected failures every ~11 years; deploy redundant components for critical systems |
| MTTR (Mean Time to Recover) | Average time from failure detection to full service restoration — measures operational response capability | MTTR is the primary KPI for IR and operations teams — lower MTTR requires better monitoring (to detect faster), documented procedures (to act faster), and practiced response (to execute reliably) |
Threats to Availability
| Threat Category | Attack / Failure Mechanism | Real-World Example |
|---|---|---|
| Ransomware | Encrypts critical systems and data, rendering them inaccessible until ransom is paid or clean restoration is achieved — most impactful availability attack in modern threat landscape | Colonial Pipeline (2021): DarkSide ransomware encrypted billing systems; pipeline operator shut down 5,500 miles of fuel pipeline; East Coast fuel shortages; $4.4M ransom paid, about $2.3M of it later seized back by the DOJ |
| Distributed Denial of Service (DDoS) | Floods target systems with traffic exceeding their capacity to respond to legitimate requests — application, protocol, and volumetric attack vectors | Dyn DNS DDoS (2016): IoT botnet (Mirai) flooded DNS provider with 1.2 Tbps; took down Twitter, Netflix, Reddit, Amazon, Airbnb, and hundreds of major websites for hours across US and Europe |
| Hardware / Infrastructure Failure | Physical failure of servers, storage, networking, or power systems — disks, power supplies, and network equipment have finite MTBF | AWS us-east-1 outages have caused cascading failures; CrowdStrike sensor update (2024) crashed 8.5 million Windows systems globally — availability failure via a trusted security tool |
| Misconfiguration / Human Error | Operator error causing outage — accidental deletion, misconfigured firewall rules, failed updates, incorrect DNS changes | AWS S3 US-East-1 outage (2017): engineer typing error during debugging accidentally removed too many servers; took down a significant portion of the internet for 4 hours |
| Natural Disasters / Physical Events | Physical infrastructure destruction — flood, fire, earthquake, hurricane, severe weather affecting data centers, power grid, or communications | Hurricane Sandy (2012): multiple New York data centers lost power or flooded; organizations without offsite DR capability suffered multi-day to multi-week outages |
| Software Bugs / Failed Updates | Application defects or failed update deployments rendering systems non-functional — zero-day software failures or poorly tested patches | CrowdStrike Falcon update (July 2024): faulty sensor configuration file caused about 8.5M Windows devices to crash globally; airlines, hospitals, banks, and broadcasters affected; estimated losses in the billions of dollars |
| Supply Chain / Third-Party Dependency | Failure or disruption of a critical third-party service or component causing cascading availability loss | Log4Shell (2021): vulnerability in a ubiquitous logging library (Log4j) forced emergency patching or shutdown of systems across every industry globally; hundreds of thousands of systems affected |
Availability Controls
| Control Type | Control | How It Protects Availability |
|---|---|---|
| Technical | Redundancy & High Availability (HA) | Eliminates single points of failure through component duplication — redundant power supplies, RAID storage, clustered servers, load balancers, multiple ISP connections. HA clusters automatically failover when one component fails. |
| Technical | Geographic Redundancy / DR Sites | Distributes infrastructure across geographically separate data centers — protects against regional disasters. Active-active (both sites serve traffic simultaneously) vs. active-passive (standby site activated on failure). |
| Technical | Backup & Recovery Systems | Regular, tested backups of all critical data — the 3-2-1-1-0 rule (3 copies, 2 media types, 1 offsite, 1 offline air-gapped, 0 untested). Immutable backups resist ransomware deletion/encryption. |
| Technical | DDoS Mitigation | Cloud-based DDoS scrubbing services (Cloudflare, AWS Shield, Akamai) absorb volumetric attacks before they reach infrastructure — essential for any internet-facing service. Anycast routing distributes attack traffic globally. |
| Technical | Monitoring & Alerting | Continuous monitoring of system health metrics (CPU, memory, disk, network, application response time) with alerting before failures become outages — proactive capacity management prevents availability surprises. |
| Technical | Content Delivery Networks (CDN) | Distributes static content and application delivery across globally distributed edge nodes — reduces origin server load; provides automatic failover; improves performance and availability for geographically distributed users. |
| Administrative | Business Continuity & DR Planning | Documented, tested plans for maintaining operations and restoring systems after disruptions — includes BIA, recovery priorities, decision trees, communication plans, and clearly assigned recovery roles. |
| Administrative | Change Management | Formal testing and approval process for all system changes before production deployment — prevents availability incidents caused by faulty updates, misconfigurations, or untested patches. |
| Administrative | Capacity Planning | Proactive assessment and provisioning of infrastructure capacity to meet current and projected demand — prevents availability degradation from resource exhaustion as usage grows. |
| Physical | UPS / Generator | Provides continuous power during grid outages — UPS provides instantaneous bridging; diesel generators for extended outages. Tier III+ data centers provide N+1 redundant power with 72+ hour fuel reserves. |
CIA Tensions, Tradeoffs, and Balance
The CIA Triad is not a set of independent properties — they interact with, reinforce, and sometimes conflict with each other in complex ways. Understanding these relationships is essential for making sound security architecture and policy decisions. Perfect security would maximize all three simultaneously; real-world security requires deliberate, defensible tradeoffs.
How CIA Properties Reinforce Each Other
| Reinforcing Relationship | Example |
|---|---|
| Confidentiality supports Integrity | Encryption protects both: it prevents unauthorized reading of data (C) AND prevents undetected modification in transit (I) — TLS provides both properties simultaneously |
| Integrity supports Confidentiality | Verified software integrity (code signing) ensures security tools haven’t been tampered with — a compromised antivirus or DLP agent directly undermines confidentiality protection |
| Availability supports Integrity | Systems that are available and functioning correctly are more likely to have complete, accurate data — availability failures (partial writes, transaction rollbacks) can corrupt data integrity |
| Integrity supports Availability | Systems with strong integrity controls are more resistant to malware — attackers who cannot modify system files or configurations have fewer paths to causing availability disruption |
| Availability enables Confidentiality enforcement | Access control systems must be available to enforce confidentiality — if the IAM system is down, users may be forced to work around controls, potentially bypassing confidentiality protections |
CIA Tensions — When Properties Conflict
| Tension | Real-World Scenario & Resolution Approach |
|---|---|
| Confidentiality vs. Availability | Strong encryption and strict access controls (C) can slow systems and complicate access (A). Healthcare example: maximum encryption of all patient records adds latency; during an emergency, a physician needs immediate access. Resolution: Risk-tiered access — emergency break-glass procedures for life-critical situations; compensating controls (enhanced logging) for emergency access events; post-access review. |
| Integrity vs. Availability | Strict integrity controls (e.g., requiring multi-party approval for every data modification) create operational friction that reduces availability of processes. Financial example: requiring dual approval for every transaction prevents fraud but slows operations. Resolution: Tiered controls by transaction value — automatic processing below threshold; dual approval above threshold; segregation of duties for high-value operations only. |
| Confidentiality vs. Integrity (Logging) | Comprehensive audit logging (I) requires capturing user activity — but those logs may contain sensitive data about what users were viewing (C). Log contents themselves become sensitive data. Resolution: Log metadata (who accessed what, when) without logging data content where possible; implement strict access controls on log repositories; encrypt log archives. |
| Availability vs. Confidentiality (Redundancy) | Geographic redundancy (A) requires replicating data to multiple data centers potentially in multiple jurisdictions — which may conflict with data residency requirements (C/privacy). Resolution: Understand data sovereignty requirements before designing DR architecture; use jurisdiction-specific replicas; apply additional encryption controls for cross-border replication. |
| Integrity vs. Availability (Patching) | Critical security patches improve integrity (I) but may require downtime or introduce compatibility issues that reduce availability (A) during the patch window. Resolution: Structured change management with tested rollback procedures; maintenance windows during low-impact periods; blue-green deployment for zero-downtime patching of critical systems. |
Decision Framework
When CIA properties conflict, resolve the tension using three questions: (1) What is the business impact of each option — which is more costly, compromised confidentiality, integrity, or availability in this context? (2) What compensating controls can reduce the cost of the necessary tradeoff? (3) Is the risk formally accepted by an accountable business owner, or is this decision being made implicitly by a technical team without business visibility?
CIA Priority by Industry Context
| Industry / Context | Primary Priority | Secondary Priority | Rationale |
|---|---|---|---|
| Healthcare / Hospital | Availability | Integrity | A physician who cannot access a patient record during surgery may make a life-threatening error. Medical data availability is literally life-critical. Integrity (accurate medical records) is close second. |
| Financial Services / Banking | Integrity | Confidentiality | Financial records that cannot be trusted destroy the institution. Unauthorized modification of account balances or transaction records is existential. Confidentiality of customer financial data is the close second. |
| Government / Defense / Intelligence | Confidentiality | Integrity | National security depends on secrecy of classified information. Disclosure of intelligence assets, military capabilities, or diplomatic communications can cause national harm. |
| E-Commerce / Retail | Availability | Confidentiality | An online retailer that is unavailable loses revenue in real time (Black Friday outage = millions lost per minute). Customer payment data confidentiality is a close second — PCI DSS compliance and breach liability. |
| Critical Infrastructure (Power/Water/OT) | Availability | Integrity | Physical systems that control power grids, water treatment, or industrial processes must remain operational — availability failures have direct physical consequences. Integrity ensures controls aren’t sending false signals. |
| Legal / Compliance / Audit | Integrity | Confidentiality | Legal and audit data must be unimpeachably accurate — tampered evidence or modified contracts are catastrophic. Attorney-client privilege and litigation hold requirements make confidentiality a close second. |
| Media / Content / Broadcasting | Availability | Integrity | A media organization whose content delivery system fails loses audience, advertising revenue, and credibility in real time. Integrity of published content (preventing false publications) is a close second. |
Regulatory Requirements and the CIA Triad
Every major cybersecurity and privacy regulation is fundamentally an expression of CIA requirements applied to a specific context. Understanding this mapping enables security professionals to translate regulatory requirements into concrete technical and administrative controls.
CIA Mapping to Major Regulatory Frameworks
| Framework / Regulation | Confidentiality | Integrity | Availability | Key CIA Requirement |
|---|---|---|---|---|
| HIPAA Security Rule | HIGH | HIGH | MEDIUM-HIGH | PHI must be protected from unauthorized access (C) and alteration (I); covered entities must ensure reasonable availability of ePHI (A); risk analysis must address all three. |
| GDPR (EU) | VERY HIGH | HIGH | MEDIUM | Art. 32: appropriate technical and organizational measures including encryption (C), ongoing confidentiality and integrity of systems (I), availability and resilience of systems (A). |
| PCI DSS v4.0 | VERY HIGH | HIGH | MEDIUM | 12 requirements focused primarily on protecting cardholder data confidentiality; integrity of card transaction data; availability of payment systems (SLA requirements in requirement 12). |
| SOX (Sarbanes-Oxley) | MEDIUM | VERY HIGH | MEDIUM | Section 404 focuses on internal controls for financial reporting integrity — preventing unauthorized modification of financial records; audit trail integrity is the primary CIA concern. |
| NIST CSF 2.0 | HIGH | HIGH | HIGH | Governs, Identifies, Protects, Detects, Responds, Recovers — explicitly designed to protect all CIA properties across critical infrastructure; Recover function directly addresses availability. |
| ISO 27001 / ISO 27002 | HIGH | HIGH | HIGH | Annex A controls explicitly mapped to C, I, and A properties; risk assessment must evaluate threats to all three; Statement of Applicability documents controls selected for each property. |
| CMMC 2.0 / NIST 800-171 | VERY HIGH | HIGH | MEDIUM-HIGH | CUI protection focuses heavily on confidentiality; system and communications protection addresses integrity; contingency planning addresses availability. |
| NY DFS 23 NYCRR 500 | HIGH | HIGH | MEDIUM-HIGH | Cybersecurity program must address C, I, and A of nonpublic information; annual penetration testing required; incident response plan required. |
| NERC CIP (Energy) | HIGH | HIGH | VERY HIGH | Critical Infrastructure Protection standards for bulk electric system — availability is paramount (power grid must stay operational); integrity of control system commands; confidentiality of cyber asset information. |
ISO 27001 Annex A Controls — CIA Mapping
| Control ID | Control Name | CIA Properties | Implementation Examples |
|---|---|---|---|
| A.5.12 | Classification of information | C I | Data classification scheme; handling requirements per classification level; labeling of sensitive documents and systems |
| A.5.14 | Information transfer | C I | Data transfer policies; encryption of sensitive data in transit; use of secure transfer protocols; NDA requirements for external transfers |
| A.5.24 | Information security incident management | C I A | Incident response plan; IR team roles; classification and reporting procedures; post-incident review process |
| A.6.8 | Reporting information security events | C I A | Incident reporting procedures; anonymous reporting mechanisms; clear escalation paths for all CIA violations |
| A.7.7 | Clear desk and clear screen | C | Screen lock policy; no sensitive documents left unattended; secure printer procedures; clean desk verification audits |
| A.8.5 | Secure authentication | C I | MFA requirements; password policy; privileged access controls; authentication event logging |
| A.8.11 | Data masking | C | Masking/tokenization of PII in non-production environments; anonymization for analytics; pseudonymization requirements for personal data |
| A.8.13 | Information backup | A I | Backup policy; frequency requirements; offsite storage; integrity verification of backups; tested restoration procedures |
| A.8.16 | Monitoring activities | C I A | Security monitoring strategy; log collection and retention; alerting thresholds; SIEM deployment; behavioral analytics |
| A.8.24 | Use of cryptography | C I | Encryption standards; key management policy; certificate lifecycle management; crypto algorithm approval list |
CIA Breach Notification Requirements
| Regulation | Confidentiality Breach Trigger | Notification Deadline | Required Recipients |
|---|---|---|---|
| GDPR | Unauthorized access to personal data of EU residents | 72 hours to supervisory authority; without undue delay to individuals if high risk | Supervisory authority (ICO, CNIL, etc.); affected individuals if risk to rights/freedoms |
| HIPAA Breach Rule | Unauthorized access, use, or disclosure of unsecured PHI | 60 days to HHS OCR; 60 days to individuals; media if 500+ in state | HHS Office for Civil Rights; affected individuals; local media (large breaches) |
| All 50 US State Laws | Unauthorized acquisition of personal information of state residents | 30–90 days (varies by state); FL/CO most restrictive at 30 days | State Attorney General; affected residents; credit bureaus (some states for large breaches) |
| SEC Cybersecurity Rules | Material cybersecurity incident (any CIA violation) | 4 business days of materiality determination; annual disclosure of risk programs | Form 8-K Item 1.05; Annual Report 10-K (risk program disclosure) |
| NIS2 Directive (EU) | Significant incident affecting CIA of network/information systems | 24 hours initial warning; 72 hours incident notification; 1 month final report | National CSIRT/competent authority; significant cross-border impact: ENISA and other EU states |
CIA in Security Architecture
How CIA Drives Security Architecture Decisions
| Architecture Decision | C | I | A | Rationale |
|---|---|---|---|---|
| Network micro-segmentation | YES | YES | YES | C: limits access to sensitive systems; I: contains lateral movement that could tamper with data; A: contains malware spread limiting blast radius of ransomware |
| End-to-end encryption | YES | YES | minor overhead | C: prevents interception; I: detects tampering in transit; minor A impact: encryption adds marginal processing overhead |
| Multi-factor authentication | YES | indirect | minor friction | C: prevents credential theft leading to unauthorized access; indirect I benefit: prevents attackers from modifying data using stolen credentials |
| Immutable, air-gapped backups | data copied | YES | YES | A: primary benefit — enables recovery from ransomware; I: backup integrity verification ensures restored data is accurate |
| File Integrity Monitoring (FIM) | – | YES | indirect | I: primary benefit — detects unauthorized modification of critical system files; indirect A benefit: detects malware that could cause availability disruption |
| DDoS mitigation service | – | – | YES | A: primary and sole purpose — absorbs attack traffic before it reaches infrastructure; no direct C or I benefit |
| Zero Trust Network Architecture | YES | YES | adds friction | C: strong: no implicit trust means unauthorized users cannot access sensitive data; I: all actions verified and logged; minor A cost: additional authentication steps |
Zero Trust Architecture and the CIA Triad
Zero Trust is the modern security architecture philosophy that assumes no user, device, or network connection is inherently trustworthy — every access request must be verified explicitly before being granted. Zero Trust is fundamentally a CIA-maximization architecture.
Zero Trust Core Principles Mapped to CIA
| Zero Trust Principle | CIA Properties Protected |
|---|---|
| Verify Explicitly — always authenticate and authorize based on all available data points (identity, location, device health, service, data classification, anomalies) | CONFIDENTIALITY: unauthorized access is blocked even with valid credentials if other risk signals are elevated; INTEGRITY: ensures actions are performed by authenticated, authorized users whose actions can be attributed |
| Use Least Privileged Access — limit user access with just-in-time and just-enough-access; risk-based adaptive policies | CONFIDENTIALITY: users can only access the minimum data required for their task; INTEGRITY: limits who can modify sensitive data; minimizes blast radius of compromised account |
| Assume Breach — minimize blast radius; segment access; verify end-to-end encryption; use analytics to get visibility, drive threat detection, and improve defenses | AVAILABILITY: contain ransomware spread through segmentation — single compromised endpoint cannot encrypt entire environment; CONFIDENTIALITY: breach of one segment cannot expose all data |
| Continuous Verification — not a one-time authentication; session risk continuously re-evaluated during access | All three CIA properties: continuous monitoring detects anomalous activity that could indicate confidentiality exfiltration, integrity tampering, or early-stage availability disruption |
Defense-in-Depth and the CIA Triad
| Defense Layer | CIA Primary Benefit | Example Controls |
|---|---|---|
| Perimeter Security | C: blocks external attackers; A: DDoS mitigation at the edge | NGFW, WAF, email security gateway, DDoS scrubbing, DMZ architecture, VPN with MFA |
| Network Security | C: limits lateral movement; A: segments ransomware; I: detects tampering via IDS/IPS | Micro-segmentation, IDS/IPS, NDR, DNS security, network access control (NAC) |
| Identity Security | C: prevents unauthorized access; I: ensures actions attributed to verified identity; A: prevents account lockout attacks | MFA, PAM, IAM, UEBA, just-in-time access, phishing-resistant authentication |
| Endpoint Security | I: prevents malware modification; A: EDR containment limits ransomware spread; C: DLP prevents endpoint exfiltration | EDR/XDR, application control, disk encryption, FIM, USB control, patch management |
| Application Security | I: prevents SQL injection data tampering; C: input validation prevents data leakage; A: WAF blocks application-layer DDoS | WAF, SAST/DAST, input validation, authentication controls, session management, secure coding standards |
| Data Security | C: encryption makes stolen data unusable; I: checksums detect modification; A: backups enable restoration | Data classification, encryption at rest and in transit, DLP, backup and recovery, data masking, tokenization |
CIA Assessment Methodology
Assessing an organization’s CIA posture requires a structured approach that identifies threats to each CIA property, evaluates the effectiveness of existing controls, and prioritizes gaps for remediation.
CIA Impact Classification
Before conducting a CIA assessment, define what each level of CIA impact means for your organization. These definitions must be approved by business leadership — not defined by IT alone:
| Level | Confidentiality Impact | Integrity Impact | Availability Impact |
|---|---|---|---|
| CRITICAL | Disclosure of data causing catastrophic harm: national security compromise; disclosure of 100,000+ records; trade secret exposure enabling competitive annihilation | Undetected modification of financial, medical, or safety-critical data causing material harm; fraud; physical injury; regulatory action | Outage of life-critical or mission-critical systems for extended period; inability to conduct primary business functions; existential organizational threat |
| HIGH | Significant breach of sensitive customer/employee data (1,000–100,000 records); IP theft; regulatory breach notification required; significant fines likely | Detected but significant modification of important records; financial data manipulation causing measurable loss; compliance violation; audit failure | Extended outage (hours) of important business systems; significant revenue loss; customer impact; SLA breaches; remediation cost > $100K |
| MEDIUM | Limited disclosure to unauthorized internal parties; small-scale PII exposure; minor regulatory implications; moderate reputational risk | Minor data corruption detected quickly; limited financial or operational impact; remediable without significant effort | Short outage (minutes to low hours) of standard business systems; moderate revenue impact; user inconvenience; some SLA impact |
| LOW | Disclosure of public or low-sensitivity internal information; no personal data; no regulatory trigger; negligible reputational impact | Minor, quickly-detected and correctable data errors; no material business or compliance impact | Brief outage or degraded performance of non-critical systems; minimal business impact; easily recovered |
| INFORMATIONAL | Theoretical disclosure risk with no realistic exploitation path; information already substantially public | Theoretical integrity risk with strong compensating controls preventing any realistic modification path | Brief or scheduled maintenance downtime; no unexpected impact; planned and communicated |
CIA Assessment Process
- Identify in-scope information assets: systems, data stores, applications, and processes to be assessed
- Classify each asset using the data classification scheme (Top Secret → Public) — classification drives CIA priority weighting
- Identify applicable threats: for each asset, enumerate threats that could compromise C, I, and A using STRIDE, MITRE ATT&CK, and sector-specific threat intelligence
- Assess existing controls: document controls currently protecting each CIA property for each asset — identify control gaps, weaknesses, and missing controls
- Rate inherent risk: likelihood × CIA impact before controls are applied
- Rate residual risk: likelihood × CIA impact after current controls are applied and their effectiveness accounted for
- Identify treatment priorities: rank gaps by residual CIA risk and remediation cost-effectiveness
- Document in Risk Register: each identified gap becomes a formal risk entry with owner, treatment plan, and target resolution date
CIA Control Effectiveness Assessment
| Level | Maturity | Description |
|---|---|---|
| 1 | Initial / Ad Hoc | Controls exist informally or inconsistently; no documented policy; protection of CIA properties depends on individual effort rather than systematic process; unpredictable outcomes |
| 2 | Developing | Basic controls documented and deployed; significant gaps remain; inconsistent implementation across the organization; tested infrequently; C, I, and A protection is partial |
| 3 | Defined | Controls formally documented and consistently implemented; tested annually; most CIA gaps addressed; some automation; protection is reliable for known threats but may miss novel attacks |
| 4 | Managed | Controls measured and monitored continuously; KPIs tracked; regular testing; integrated into risk management process; near-complete CIA coverage; proactive rather than reactive |
| 5 | Optimizing | Continuous improvement; automated detection and response; threat intelligence feeds inform control updates; industry leadership posture; CIA protections adapt ahead of emerging threats |
CIA Metrics for Ongoing Measurement
| Metric | CIA Property | Measurement | Target |
|---|---|---|---|
| % sensitive data stores with encryption enabled | C | Quarterly audit | 100% of Confidential and above data stores |
| % endpoints with DLP agent deployed | C | Continuous (MDM/agent reporting) | 100% of managed endpoints |
| Mean time to detect credential compromise | C | Measured per incident | < 24 hours from initial compromise |
| % critical files covered by FIM | I | Quarterly audit | 100% of Tier 1 system critical files |
| % code releases with signed commits / code signing | I | CI/CD pipeline metrics | 100% of production releases |
| Change management compliance rate | I | Quarterly audit of production changes | >= 99% of changes through formal CM process |
| Actual RTO vs. Target RTO (last DR test) | A | Post-DR-test measurement | Actual RTO <= Target RTO for all Tier 1 systems |
| Backup restoration success rate | A | Monthly test restorations | 100% success rate on tested backup sets |
| System uptime for critical services | A | Continuous monitoring | >= 99.9% for Tier 1; >= 99.5% for Tier 2 |
| Security awareness training completion | C I A | LMS reporting | >= 95% of all staff; 100% of high-risk roles |
Extended CIA Models
The CIA Triad has served information security well for over four decades, but the modern threat landscape has exposed properties that CIA alone does not fully capture. Several extended models have been developed to address these gaps while preserving the triad as the foundational core.
The Parkerian Hexad
Donn Parker (1998) proposed extending the CIA Triad to six properties — the Parkerian Hexad — to address additional security dimensions that CIA does not fully describe:
| Property | Definition | Example Scenario |
|---|---|---|
| C Confidentiality (CIA) | Information accessible only to authorized parties | Data breach exposing customer records to unauthorized parties |
| I Integrity (CIA) | Information accurate and unaltered by unauthorized parties | SQL injection used to modify financial records |
| A Availability (CIA) | Information accessible when needed by authorized users | Ransomware encrypting systems causing operational shutdown |
| Possession / Control | Physical possession or control of information assets, independent of confidentiality — focuses on who holds the data, not just who can read it | An attacker steals an unencrypted laptop containing sensitive data. Confidentiality may be preserved (if disk is encrypted), but possession is lost — the owner no longer controls the physical asset |
| Authenticity | Verifying that data, messages, or users are genuine and originate from claimed sources — addresses identity, not just secrecy | BEC attack where an attacker sends email appearing to be from the CEO. The email is confidential, has not been tampered with, and is available — but it is not authentic. Only authentication controls (DMARC, DKIM) address this. |
| Utility | Information is in a usable form for its intended purpose — format, completeness, and currency | An encrypted backup that cannot be decrypted because the key was lost maintains confidentiality and possession but has zero utility — the data is inaccessible for its intended purpose despite technically being ‘available’ |
Non-Repudiation — The Critical Addition
Non-repudiation is the ability to prevent an entity from denying that a specific action was performed. It is closely related to both integrity and authenticity, but distinct from both:
- In financial transactions: non-repudiation ensures that a party who authorized a wire transfer cannot later deny doing so — essential for fraud investigation and legal proceedings
- In digital contracts: digital signatures with trusted timestamps provide cryptographic non-repudiation — the signer cannot deny their signature without invalidating the cryptographic proof
- In security incidents: comprehensive audit logging with authenticated user attribution provides non-repudiation for security actions — essential for insider threat investigation and compliance
- In email: DKIM signatures, S/MIME certificates, and preserved email headers provide non-repudiation for business communications in litigation contexts
Non-Repudiation in Practice
Non-repudiation requires both integrity (the log/record has not been tampered with) AND authenticity (the identity attribution is trustworthy). A log of user actions provides non-repudiation only if: (1) the log cannot be modified (append-only, WORM storage), (2) the user identity was strongly authenticated (MFA, certificate-based auth), and (3) the log is protected from deletion or alteration by the accused. Shared accounts destroy non-repudiation entirely — multiple people using the same account means no one can be held accountable.
Privacy as an Extension of Confidentiality
Privacy is closely related to confidentiality but distinct: confidentiality protects specific information from unauthorized disclosure; privacy protects an individual’s right to control information about themselves and how it is used.
| Dimension | Confidentiality | Privacy |
|---|---|---|
| Focus | Protecting information from unauthorized access | Protecting individuals’ rights over their personal information |
| Harm prevented | Unauthorized disclosure of sensitive information | Violation of personal autonomy; use of data in ways individuals did not consent to |
| Example breach | Hacker steals employee medical records | Employer analyzes employee health data to make promotion decisions — even without hacking, even if data was ‘authorized’ |
| Regulatory framework | Addressed by security standards (ISO 27001, NIST) | Addressed by privacy law (GDPR, CCPA, HIPAA Privacy Rule) |
| Key principle | Access control, encryption, need-to-know | Purpose limitation, data minimization, consent, right to erasure, transparency |
Applying the CIA Triad — Case Studies
The CIA Triad is most powerfully understood through real-world application. The following case studies examine landmark security incidents through the CIA lens — identifying which properties were violated, what controls failed, and what should have been in place.
Case Study: Equifax Data Breach (2017) — Confidentiality Failure
| Incident Summary | Apache Struts vulnerability (CVE-2017-5638) exploited in Equifax’s online dispute portal. Attackers maintained access for about 76 days (GAO) and exfiltrated 147 million consumers’ PII — SSNs, dates of birth, addresses, driver’s license numbers, credit card numbers. |
| CIA Properties Violated | PRIMARY: CONFIDENTIALITY — 147M records of highly sensitive PII disclosed to unauthorized external actors. SECONDARY: INTEGRITY — some evidence of database manipulation. Availability was maintained, ironically making the breach harder to detect. |
| Control Failures | 1) Unpatched known vulnerability (patch available 2 months before exploitation — patch management failure) 2) No network segmentation — once inside, attackers moved laterally without resistance 3) Unencrypted SSN data at rest — encryption would have made exfiltrated data unusable 4) Inadequate monitoring — 78-day dwell time undetected (no DLP, no anomaly detection on outbound traffic) 5) Expired TLS certificate on internal traffic inspection tool — left attackers’ traffic invisible for 19 months |
| Required Controls | Patch management program with SLA (critical CVEs patched within 15 days); network micro-segmentation; data-at-rest encryption for all PII; DLP monitoring for large outbound data transfers; renewed TLS certificates; regular penetration testing |
| Business Consequences | Global settlement of at least $575M and up to $700M with the FTC, CFPB, and 50 states and territories, including a consumer fund of up to $425M; congressional hearings; CEO, CISO, and CIO all departed; affected consumers could claim up to 10 years of free credit monitoring |
Case Study: SolarWinds Supply Chain (2020) — Integrity Failure
| Incident Summary | Russian SVR hackers (Cozy Bear) compromised SolarWinds’ software build pipeline and injected malicious code (SUNBURST backdoor) into a signed, legitimate software update. 18,000 organizations installed the compromised Orion update; 100 organizations were actively exploited including US Treasury, DOJ, DHS, and major corporations. |
| CIA Properties Violated | PRIMARY: INTEGRITY — the software supply chain was compromised; legitimate, digitally-signed software was modified to include a backdoor. SECONDARY: CONFIDENTIALITY — SUNBURST was used for intelligence collection; classified government communications were read by adversaries. Availability was deliberately not violated — attackers maintained stealth. |
| Control Failures | 1) Insufficient build pipeline security — development environment was not adequately isolated or monitored 2) No build integrity verification beyond signing — signed ≠ secure; signing only proves who signed, not that the content is legitimate 3) No SBOM verification — customers had no mechanism to detect that the update content differed from expected 4) Overprivileged software — Orion had excessive network permissions enabling extensive lateral movement once installed 5) Inadequate network monitoring — SUNBURST’s traffic mimicked legitimate SolarWinds traffic, bypassing signature-based detection |
| Required Controls | Secure software development lifecycle (SSDLC); reproducible builds; build pipeline access controls; SBOM generation and verification; software composition analysis; network segmentation for monitoring tools; behavioral-based anomaly detection (SUNBURST was eventually caught by behavioral analysis, not signatures) |
| Business Consequences | SolarWinds: stock price fell sharply after disclosure; the SEC charged the company and its CISO in 2023 over its security disclosures, but a court dismissed most claims in 2024 and the SEC dropped the rest in November 2025. US Government: networks at multiple federal agencies compromised; months-long investigation and remediation; Executive Order 14028 on software supply chain security |
Case Study: Colonial Pipeline Ransomware (2021) — Availability Failure
| Incident Summary | DarkSide ransomware entered Colonial Pipeline’s network via a compromised VPN account — the account’s password appeared in a leaked credentials database, and the VPN did not require MFA. Ransomware encrypted billing systems; Colonial proactively shut down the 5,500-mile pipeline serving the US East Coast. |
| CIA Properties Violated | PRIMARY: AVAILABILITY — the pipeline supplying ~45% of East Coast fuel was shut down for 6 days causing fuel shortages across multiple states. SECONDARY: CONFIDENTIALITY — DarkSide exfiltrated ~100GB of data before deploying ransomware (double extortion). Integrity was partially violated as ransomware encrypted data. |
| Control Failures | 1) No MFA on VPN — single stolen credential was sufficient for network access 2) Legacy credentials in breach databases — password not changed after previous exposure 3) No network segmentation — IT and OT networks not properly separated; ransomware could threaten pipeline operations 4) Insufficient backup and recovery capability — inability to rapidly restore billing systems drove the $4.4M ransom payment decision 5) Lateral movement detection — attackers moved through the network undetected before deploying ransomware |
| Required Controls | MFA on ALL remote access — no exceptions; credential breach monitoring and automatic password reset notification; network segmentation between IT/OT environments; tested, offline backup and recovery capability meeting RTO requirements; EDR with behavioral detection; incident response plan addressing ransomware specifically |
| Business Consequences | $4.4M ransom paid (about $2.3M later recovered by the DOJ); US declared regional emergency; fuel prices spiked; CEO testified before Congress; pipeline forced to report to CISA and TSA; new TSA cybersecurity directives issued for critical infrastructure pipeline operators |
Tabletop Exercise Scenarios
Use these scenarios for team discussion and tabletop exercises. For each scenario, identify: (1) Which CIA properties are threatened? (2) What controls should have prevented this? (3) What is the immediate response priority?
Scenario A — Confidentiality
A security analyst receives a dark web monitoring alert that 15,000 employee email addresses and hashed passwords from your organization appear in a credential dump forum post dated three days ago. Your organization uses these email addresses as usernames for all internal systems. How do you respond? Which CIA properties are affected? What is your 1-hour action plan?
Scenario B — Integrity
During a quarterly audit, a financial analyst discovers that 47 wire transfers totaling $2.3M were processed over the past 6 months by a single accounts payable clerk who is supposed to require supervisor approval for transfers above $10,000. The audit trail shows all transfers were approved — but the approving supervisor says she never approved them. Which CIA properties are affected? What do you investigate first? What does the investigation tell you about your controls?
Scenario C — Availability
At 7:45 AM on a Monday, your SIEM fires multiple critical alerts: ‘Mass file rename event detected on Finance01, Finance02, and FileServer03.’ Within 5 minutes, the Finance Director calls to say she cannot open any Excel files — they all have a .locked extension. The IT Director says the same is happening on servers across three departments. What are your first five actions? What is your communication plan? What determines whether you pay a ransom?
Scenario D — All Three CIA Properties
An IT administrator who resigned last Friday is discovered to have, in their final week: (1) downloaded 40GB of customer data to a personal USB drive; (2) modified access control lists to give a dormant external account administrative permissions; (3) changed backup schedules to run only monthly instead of daily. Identify the CIA violations for each action. Describe your immediate remediation priorities in order. What long-term controls would have prevented all three?
Quick Reference — CIA Triad Summary
| Property | Core Question | Key Threat Examples | Key Control Examples |
|---|---|---|---|
| CONFIDENTIALITY | Is this information accessible ONLY to authorized parties? | Data breach; eavesdropping; insider exfiltration; credential theft; misconfigured storage; phishing | Encryption (at rest + in transit); access control; MFA; DLP; data classification; need-to-know; secure disposal |
| INTEGRITY | Is this information accurate and unaltered by unauthorized parties? | Malware/ransomware file corruption; SQL injection; insider manipulation; supply chain compromise; MitM tampering; configuration drift | Cryptographic hashing; digital signatures; FIM; audit logging; input validation; change management; segregation of duties |
| AVAILABILITY | Is this information accessible to authorized users WHEN THEY NEED IT? | Ransomware encryption; DDoS; hardware failure; misconfiguration; natural disasters; software bugs; supply chain failure | Redundancy; geographic DR; tested backups (3-2-1-1-0); DDoS mitigation; monitoring; BC/DR planning; capacity planning; RTO/RPO management |
CIA Triad Key Terms Glossary
| Term | Definition |
|---|---|
| CIA Triad | The three foundational properties of information security: Confidentiality (authorized access only), Integrity (accurate and unaltered), Availability (accessible when needed) |
| Confidentiality | The property that information is not made available to unauthorized individuals, entities, or processes |
| Integrity | The property that data is accurate, complete, and has not been modified by unauthorized parties; includes system integrity and transmission integrity |
| Availability | The property that information and systems are accessible and operational when authorized users require them |
| Non-Repudiation | The ability to prove that a specific action was performed by a specific party who cannot later deny it — requires both integrity and authenticity |
| Authenticity | The property that data, messages, or users are genuine and originate from the claimed sources — distinct from confidentiality and integrity |
| Possession / Control | Parkerian Hexad addition: physical or logical control over information assets, independent of the ability to read or modify the data |
| Utility | Parkerian Hexad addition: information is in a form usable for its intended purpose — data that cannot be decrypted has no utility regardless of other CIA properties |
| Parkerian Hexad | Six-property extension of the CIA Triad (Donn Parker, 1998): Confidentiality + Integrity + Availability + Possession + Authenticity + Utility |
| Data Classification | Assignment of sensitivity labels (Public, Internal, Confidential, Top Secret) to data — determines CIA handling requirements, access controls, and retention policies |
| Defense in Depth | Layering multiple security controls so the failure of any single control does not result in complete loss of any CIA property |
| Zero Trust | Security architecture principle: never trust, always verify — every access request verified regardless of network location; maps to maximizing all three CIA properties |
| RTO | Maximum acceptable time from disruption to restoration of a system — the availability promise to the business; drives DR architecture investment |
| RPO | Maximum acceptable data loss measured in time — drives backup frequency and replication investment to protect data availability and integrity |
| Data Integrity | Assurance that data has not been modified, added to, or deleted by unauthorized parties since creation or last authorized modification |
| Cryptographic Hash | A mathematical function that creates a fixed-size ‘fingerprint’ of data — any modification changes the hash, making it the primary technical control for detecting integrity violations |
| FIM | Continuous monitoring of system files for unauthorized changes — primary detective control for integrity violations in operating systems, configurations, and application files |
| 3-2-1-1-0 Backup Rule | Availability best practice: 3 copies of data, on 2 different media types, with 1 offsite, 1 offline/air-gapped, and 0 untested backups |
Appendix A: CIA Triad Controls Quick Reference
| Control | C | I | A | Notes |
|---|---|---|---|---|
| AES-256 Encryption (at rest) | ✓✓ | – | – | Primary C control; stored data useless to attacker even if stolen |
| TLS 1.3 (in transit) | ✓✓ | ✓ | slight overhead | C: prevents interception; I: prevents MitM modification; slight A overhead |
| MFA / FIDO2 hardware key | ✓✓ | ✓ | – | C: blocks credential-based access; I: ensures actions attributed to verified identity |
| Role-Based Access Control (RBAC) | ✓✓ | ✓ | – | C: limits who can read data; I: limits who can modify data; enforces need-to-know |
| Data Loss Prevention (DLP) | ✓✓ | – | – | C: blocks unauthorized data transmission; no direct I or A benefit |
| SHA-256 Cryptographic Hash | – | ✓✓ | – | I: primary tool for detecting any unauthorized data modification |
| Digital Signatures (PKI) | ✓ | ✓✓ | – | I: primary: detects tampering; C: confirms source authenticity; non-repudiation |
| File Integrity Monitoring (FIM) | – | ✓✓ | – | I: detects unauthorized changes to critical system files; PCI DSS required |
| Database Transaction Logging | – | ✓✓ | – | I: comprehensive record of all data modifications; forensic timeline; SOX relevant |
| Segregation of Duties (SoD) | ✓ | ✓✓ | – | I: primary: prevents single-person fraud/manipulation; C: limits access scope |
| Input Validation | – | ✓✓ | ✓ | I: primary: prevents injection attacks corrupting data; A: prevents resource exhaustion via malformed input |
| Geographic Redundancy / DR | – | – | ✓✓ | A: primary: survives regional disaster; no direct C or I benefit |
| 3-2-1-1-0 Backup Strategy | ✓ | ✓ | ✓✓ | A: primary; I: backup verification ensures integrity; C: offsite copies need encryption |
| DDoS Mitigation (Cloudflare, AWS Shield) | – | – | ✓✓ | A: sole purpose; absorbs volumetric attacks; no C or I benefit |
| High Availability (HA) Clustering | – | – | ✓✓ | A: automatic failover eliminates single points of failure; no direct C or I benefit |
| Change Management Process | ✓ | ✓✓ | ✓ | I: primary: prevents unauthorized system modifications; A: prevents outages from failed changes; C: documents access to sensitive systems |
| Security Awareness Training | ✓✓ | ✓ | ✓ | C: primary: reduces phishing/social engineering risk; all three CIA properties benefit |
| SIEM + EDR + Continuous Monitoring | ✓ | ✓ | ✓ | Detects violations of all three CIA properties; not prevention but detection and response |
Appendix B: CIA Assessment Worksheet
Use this worksheet to conduct a CIA assessment on any information asset. Complete one worksheet per asset or asset group.
| Assessment Field | Response / Rating |
|---|---|
| Asset Name / Description | |
| Asset Owner (Business) | |
| Asset Classification (Public / Internal / Confidential / Top Secret) | |
| C Who should have access to this data? Who should NOT? | |
| C What are the top 3 threats to data confidentiality for this asset? | 1. 2. 3. |
| C Current controls in place | |
| C Control gaps identified | |
| C Residual Risk Rating (Critical / High / Medium / Low) | |
| I What would be the impact if this data were modified without authorization? | |
| I What are the top 3 threats to data integrity for this asset? | 1. 2. 3. |
| I Current controls in place | |
| I Control gaps identified | |
| I Residual Risk Rating (Critical / High / Medium / Low) | |
| A What is the RTO (max acceptable downtime)? | |
| A What is the RPO (max acceptable data loss)? | |
| A What are the top 3 threats to availability for this asset? | 1. 2. 3. |
| A Current controls in place | |
| A Control gaps identified | |
| A Residual Risk Rating (Critical / High / Medium / Low) | |
| Overall CIA Risk Priority (highest of C/I/A ratings) | |
| Treatment Plan Summary | |
| Risk Owner | |
| Next Review Date |
Appendix C: Recommended Resources
- NIST SP 800-53 Rev 5 — Security and Privacy Controls for Information Systems and Organizations (maps controls to CIA properties)
- NIST SP 800-30 Rev 1 — Guide for Conducting Risk Assessments (CIA-based impact assessment methodology)
- ISO/IEC 27001:2022 / ISO/IEC 27002:2022 — Information Security Management (CIA-aligned control framework)
- NIST Cybersecurity Framework 2.0 — csrc.nist.gov/projects/cybersecurity-framework (CIA applied across six functions)
- FIPS 199 — Standards for Security Categorization of Federal Information (defines CIA impact levels for federal systems)
- Donn Parker, ‘Fighting Computer Crime’ (1998) — original source of the Parkerian Hexad extending the CIA Triad
- ISACA COBIT 2019 — governance framework with CIA properties integrated into enterprise risk management
- MITRE ATT&CK Framework — attack.mitre.org (maps adversary techniques to CIA violations; essential for threat modeling)
- OWASP Top 10 — owasp.org (application-layer CIA violations with specific web security context)
- CIS Critical Security Controls v8 — cisecurity.org (18 controls mapped to CIA protection across the attack lifecycle)