Confidentiality, integrity and availability

Keisha's whiteboard in the Brightline meeting room had one permanent drawing on it, protected by a strip of tape that warned the cleaners not to erase it: a triangle with three words at its corners. Confidentiality, integrity, availability. "Every security question we get from a client," she told Jordan, "comes down to one of these three. Somebody is worried that the wrong person will see something, that something will be changed when it should not be, or that something will not be there when they need it." She asked Jordan to spend the afternoon sorting the previous month's security tickets by corner of the triangle.

This model is usually called the CIA triad, and it is the foundation of the exam's first domain. It is not a technology and it does not tell you what to buy. It is a way of asking the right questions about any system: what are we protecting, what would harm look like, and which control addresses that harm? This lesson takes each of the three properties in turn, then adds the related ideas of authenticity and non-repudiation, and ends with the balance every organization has to strike between them.

Confidentiality

Confidentiality means that information is available only to people, processes and devices that are authorized to see it. A breach of confidentiality is a disclosure: client files emailed to the wrong address, a laptop with unencrypted patient records stolen from a car, a database left open to the internet, or a staff member browsing records out of curiosity. The harm does not depend on anyone changing the data. Once information has been seen by the wrong person, it cannot be unseen, which is why confidentiality failures are often the most expensive and the most damaging to trust.

Controls that protect confidentiality include access control, which limits who can open a file or system; encryption, which makes data unreadable without the right key, both when it is stored and when it travels across a network; and classification, which labels information by sensitivity so that people know how to handle it. Physical controls matter too: a locked server cabinet, a privacy screen on the reception computer at Prairie Paws Veterinary Clinic, and a rule that printed client files at Riverside Family Law go into a locked shred bin rather than the recycling.

Privacy is closely related but not identical. Confidentiality is about protecting information from unauthorized access; privacy is about the rights of the people the information describes, including their right to know what is collected and why. A system can keep data confidential and still breach privacy, for example by collecting more personal information than it needs or using it for a purpose the person never agreed to. Privacy laws in the United States, such as state consumer privacy laws and HIPAA, set rules for both.

Integrity

Integrity means that information and systems are accurate, complete and changed only in authorized ways. A breach of integrity is an unauthorized or accidental change: an attacker altering the bank account number on an invoice, a mistyped price in the bakery's point-of-sale system, a corrupted backup, or malware modifying a system file. Integrity failures can be harder to notice than confidentiality failures because the data still looks normal. A changed number in a spreadsheet does not announce itself.

Controls that protect integrity include permissions that limit who can write or change data, hashing to detect changes in files and messages, digital signatures that show who created a document and that it has not been altered, input validation in applications, change control processes for systems, and version history and backups so that a bad change can be reversed. Integrity also applies to systems and configurations, not just data. A firewall rule changed without approval is an integrity problem even if no data was touched.

Jordan found a good integrity example in the ticket history. In September, the office manager at Kettle & Crumb Bakery had received an email, apparently from the flour supplier, saying that the supplier's bank details had changed. She had almost updated the payment record before calling the supplier, who knew nothing about it. The email was fraudulent. Nothing secret had been stolen; the attack aimed to change a record so that money would go to the wrong place. The control that saved the bakery was a simple procedure: confirm any change of payment details by phone, using a number already on file.

import hashlib
invoice = b"Pay Prairie Flour Co. 1,240.00 to account 0041-778812"
altered = b"Pay Prairie Flour Co. 1,240.00 to account 0041-778813"
for label, data in (("original", invoice), ("altered", altered)):
    print(label, hashlib.sha256(data).hexdigest()[:32])
print("same?", hashlib.sha256(invoice).digest() == hashlib.sha256(altered).digest())

original 7d8dbf284794eafc19ba76bb00596fa3
altered ce28fdbe45167d1163161401fa6d5eea
same? False

The short program above shows why hashing supports integrity. Changing a single digit in the account number produces a completely different SHA-256 hash. If the sender publishes or signs the hash of the original, the receiver can detect any change. Lesson 11 returns to hashing and signatures in more detail.

Availability

Availability means that information and systems are accessible to authorized users when they need them. A breach of availability is an outage: a ransomware attack that locks every file, a flood of traffic that overwhelms a website, a failed hard drive with no backup, a power cut, or simply a misconfiguration that takes a server offline. For the bakery, an hour without its point-of-sale system on a Saturday morning is lost sales and a line of annoyed customers. For a hospital, unavailable systems can harm patients.

Controls for availability include redundancy, such as spare power supplies, two internet connections and clustered servers; backups that are tested and stored where an attack cannot reach them; capacity planning; protection against denial-of-service traffic; maintenance and monitoring; and plans for recovering when something fails anyway. Availability is often measured as uptime, the share of time a service is working. A service that is available 99.9 of every 100 hours sounds excellent until you work out what the remainder means over a year.

The triad in everyday support work

Keisha pointed out that most security decisions on the help desk are small ones, and the triad still applies. When a user asks for a shared folder to be opened to the whole office, the question is confidentiality: does everyone really need to see it? When a manager asks for a technician to edit a spreadsheet of prices on their behalf, the question is integrity: is there a record of who changed what, and can the old version be restored? When a clinic asks to postpone updates until after the busy season, the question is availability balanced against the integrity risk of running unpatched software. Naming the property turns a vague worry into a question with an answer.

Jordan's sorted list of October's tickets made the pattern visible. Of 42 tickets with a security angle, he placed 19 under confidentiality, mostly permission requests and lost devices; 9 under integrity, including two suspicious payment-change emails and an accidental bulk edit in the bakery's inventory sheet; and 14 under availability, from a failed backup job to a website outage caused by an expired certificate. Several could have gone in more than one corner. Keisha said that was fine; the value is in asking the question, not in perfect sorting.

The exercise also showed how often the fix was a process rather than a product. Permission requests needed a rule that the data owner approves access. Payment changes needed a call-back procedure. Backups needed someone to read the failure alerts. Technology helps, but most of the controls that protected Brightline's clients that month were habits written into procedures.

Measuring and promising availability

Availability targets are often written as a number of nines. Three nines, 99.9 of every 100 hours, allows about 8.8 hours of downtime a year; four nines allows under an hour; five nines allows about five minutes. Each extra nine costs far more than the last, because it needs redundant hardware, redundant connections, automatic failover and staff on call. A small business rarely needs or can afford four nines for everything. The bakery's point-of-sale system needs high availability on weekends, while its office laptop can be out for a day without much harm. Matching the target to the need keeps costs sensible.

Two related measures help planning. The recovery time objective is how long a system can be down before the harm becomes unacceptable. The recovery point objective is how much data, measured in time, the organization can afford to lose, which decides how often backups must run. CSCO-122 returns to these in the lesson on business continuity.

Authenticity and non-repudiation

Two more properties often appear alongside the triad. Authenticity means that information or a message really comes from the source it claims to come from, and that a user or device is who it claims to be. The fake supplier email failed the authenticity test: it claimed to come from the flour company and did not. Authentication, the process of proving identity, supports authenticity and is covered in lesson 10.

Non-repudiation means that someone cannot credibly deny an action they took. If a lawyer at Riverside Family Law digitally signs a document, the signature, made with a private key only she controls, provides strong evidence that she signed it. Audit logs that record who did what and when also support non-repudiation, provided they are protected from tampering. Non-repudiation matters most in legal, financial and contractual settings, where proof of who did something has consequences.

Some models extend the triad further, for example with accountability, the idea that every action can be traced to the person who took it. You do not need to memorize every extended model, but you should recognize the terms and be able to place a scenario under the right property.

Balancing the three

The three properties can pull against each other. Strong encryption and strict access control protect confidentiality but can make data harder to reach in an emergency, a cost to availability. Locking every file so that only one person can change it protects integrity but slows work. Making a system available from anywhere, on any device, helps availability but widens the ways confidentiality could fail. Security design is the work of finding the right balance for each system, given what it holds and who depends on it.

The balance depends on the business. Keisha asked Jordan which property mattered most for each of Brightline's four regular clients. For Riverside Family Law, confidentiality comes first: client privilege and professional rules make disclosure a disaster. For Kettle & Crumb Bakery, availability of the point-of-sale system is the daily priority, with integrity of payment records close behind. For Prairie Paws, all three matter, because medical records must be accurate, private and available during appointments. For the Northfield Community Center, the public Wi-Fi needs availability, while the staff systems that hold members' personal information need confidentiality.

When you read an exam scenario, start by asking which property is threatened. A stolen backup tape is a confidentiality problem. A tampered log file is an integrity problem. A server knocked offline is an availability problem. Many real events affect more than one: ransomware that encrypts files hits availability, and if the attackers also copied the files before encrypting them, as many now do, it hits confidentiality too.