If you learn only one model in this entire course, make it this one. The CIA Triad is the foundation that security is built on. (It has nothing to do with the spy agency!)
What is it?
CIA stands for three goals that every security control is trying to protect:
Select any component in the diagram to read what it does.
Text description of this diagram
The three goals of security: keep data secret (Confidentiality), correct (Integrity) and available when needed (Availability).
- Confidentiality — only the right people can see the information. (Keeping secrets secret.)
- Integrity — the information is correct and has not been tampered with. (Keeping data trustworthy.)
- Availability — the information and systems are there when you need them. (Keeping things running.)
Why is it important?
Every attack harms at least one side of the triad, and every defence protects one or more. When you are not sure why a security measure matters, ask: which part of the CIA Triad does this protect?
How does it work?
| Goal | Protects against | Example control |
|---|---|---|
| Confidentiality | Data being seen by the wrong people | Encryption, passwords, access control |
| Integrity | Data being changed or faked | Backups, checksums, version history |
| Availability | Systems going down or being blocked | Backups, redundancy, DDoS protection |
A real-world example
Think of your online bank balance. Confidentiality: no stranger should see it. Integrity: the number must be accurate — nobody should be able to change it. Availability: you must be able to check it when you need to. A good bank protects all three at once.
Check what you learned
What do the letters C, I, and A stand for?
Confidentiality, Integrity, and Availability.
Which goal is harmed if an attacker secretly changes a bank balance?
Integrity — the data is no longer correct and trustworthy.
Which goal does a ransomware attack that locks your files mainly harm?
Availability — the files and systems are no longer there when you need them.
Key takeaways
- The CIA Triad is Confidentiality, Integrity, and Availability.
- Every attack harms one of these; every defence protects one or more.
- When in doubt, ask which part of the triad a control protects.