What Is the CIA Triad? Confidentiality, Integrity and Availability Explained

What is the CIA triad? It is the model security teams use to describe what they protect. The three letters stand for confidentiality, integrity and availability. Confidentiality means only the right people can see data. Integrity means data is correct and nobody has changed it without permission. Availability means systems and data are there when people need them. Every security control and every cyberattack touches at least one of the three. This post explains each goal, shows a real attack on each one, and gives you commands to check all three on your own systems.

Where the CIA triad comes from

The name has nothing to do with the American intelligence agency. It comes from the three goals that security standards have listed together for decades. US federal law defines information security as protecting confidentiality, integrity and availability, in 44 U.S.C. § 3552. The US standard FIPS 199, published in 2004, rates every government system by how much harm a loss of each goal would cause.

The diagram below sums up the three goals, what protects each one, and an attack that harms it.

The CIA triad: confidentiality, integrity and availability, each with what protects it and an example of an attack that harms it.

Confidentiality

Confidentiality means only people with permission can see the data. A payroll file should be open to the payroll team, not to the whole company. Access rights, passwords, multi-factor authentication and encryption all protect confidentiality.

A loss of confidentiality is a data breach. In 2017, threat actors broke into the US credit agency Equifax through a known flaw in the Apache Struts web framework, CVE-2017-5638. A patch had been out for two months. The threat actors stole the personal details of about 147 million people.

Integrity

Integrity means data is accurate and complete, and nobody has changed it without permission. It applies to software as well as data. Hashes, digital signatures, change logs and backups protect integrity, and let you prove that something has not changed.

A loss of integrity can be hard to spot, because the data still looks normal. In December 2020, investigators found that threat actors had added malicious code to updates for SolarWinds Orion, a network monitoring product. The updates were signed and looked genuine, and up to 18,000 customers installed them. MITRE ATT&CK calls this technique Compromise Software Supply Chain (T1195.002).

Availability

Availability means systems and data are there when people need them. Spare hardware, backups, tested recovery plans and protection against floods of traffic all keep services available.

On 12 May 2017, the WannaCry ransomware spread across the world through a flaw in Windows file sharing, CVE-2017-0144. In England, the National Audit Office found that it disrupted at least 81 NHS trusts. Around 19,000 appointments were cancelled. Availability can also fail without an attack. On 19 July 2024, a faulty CrowdStrike update crashed about 8.5 million Windows computers, grounding flights and closing services.

A worked example: one incident, three goals

Most real incidents harm more than one goal. Ransomware shows this well. Picture a threat actor who gets into a company's file server:

  1. They copy the files out first. The company loses confidentiality, because the files are now in the threat actor's hands.
  2. They encrypt the files. The company loses integrity, because someone without permission has changed every file.
  3. They delete the backups and demand payment. The company loses availability, because staff cannot open anything and there is nothing to restore.

MITRE ATT&CK lists the encryption step as Data Encrypted for Impact (T1486). Thinking in terms of the triad helps you see that restoring the files is not the end. Even after recovery, the stolen data is still out there, and the company may have to tell its customers and regulators.

Checking the triad on your own systems

You can check each goal with built-in commands. The examples use a file called payroll.csv and a website at shop.example.com.

Confidentiality: who can read a file?

Windows PowerShell

Get-Acl .\payroll.csv | Format-List AccessToString

Windows Command Prompt

icacls payroll.csv

Linux

ls -l payroll.csv

macOS and BSD

ls -l payroll.csv

On Linux, the result might look like this:

-rw-r--r-- 1 alice payroll 48213 Jan 25 09:14 payroll.csv

The last r-- means every user on the system can read the file. That is a confidentiality problem. Running chmod 640 payroll.csv limits reading to the owner and the payroll group.

Integrity: has a file changed?

Take a hash of the file when you know it is correct, then compare it later. If even one character changes, the hash changes completely.

Windows PowerShell

Get-FileHash .\payroll.csv -Algorithm SHA256

Windows Command Prompt

certutil -hashfile payroll.csv SHA256

Linux

sha256sum payroll.csv

macOS and BSD

shasum -a 256 payroll.csv

Our post on Base64, encryption and hashing explains why a hash proves integrity but hides nothing.

Availability: is a service answering?

Windows PowerShell

Test-NetConnection shop.example.com -Port 443

Windows Command Prompt

curl -s -o NUL -w "%{http_code}" https://shop.example.com

Linux

curl -s -o /dev/null -w '%{http_code}\n' https://shop.example.com

macOS and BSD

curl -s -o /dev/null -w '%{http_code}\n' https://shop.example.com

A result of 200 means the site answered. Monitoring tools run checks like this every minute and raise an alert when one fails.

Balancing the three goals

The three goals often pull against each other. Locking a file away makes it more confidential but less available. Adding approval steps protects integrity but slows work down. A good security decision finds the right balance for each asset. An online shop needs strong confidentiality for card details, strong integrity for prices and strong availability for its website.

Many organisations also track two more goals: authentication, proving who someone is, and non-repudiation, proving who did something so they cannot deny it. With the triad, these make up the five pillars of information assurance.

Why the CIA triad matters for your career

The CIA triad appears in almost every entry-level certification exam and many job interviews. Interviewers often describe an incident and ask which goals it harmed. The worked example above is a good way to practise your answer. Our post on becoming a SOC analyst with no experience covers the other skills employers look for at entry level.

The Introduction to Cyber module teaches the CIA triad alongside the threat actors, malware and defences that put it to the test.

Further reading