CIA Triad

---

The CIA triad is a model by which you can think about and discuss security concepts.

• Sometimes written
  • as CAI
  • in its negative: DAD (disclosure, alteration, and denial)
• 3 principles of security control and management
• called security services or security properties

The three primary concepts in information security are:

• confidentiality
• integrity
• availability

Confidentiality

Confidentiality ensures that data is accessible only by authorized users.

• Protects against unauthorized disclosure
• Enforce confidentiality with access controls
• Focuses on secrecy and privacy

Integrity

Integrity ensures data has not been tampered with and is correct, authentic, and reliable.

• Enforce integrity with:
  • file permissions
  • user access controls
  • version control
  • redundant systems or copies
• Focuses on reliability and accuracy

Availability

Availability ensures reliable access to data/information for authorized individuals.

• Methods for maintaining availability:
  • rigorously maintaining all hardware
  • testing compatibility with operating systems and installed applications
  • keeping systems patched and up-to-date
• Focuses on accessibility and uptime