What cyber security protects: the CIA triad

Why we need a simple model

Security can feel huge: viruses, hackers, leaks, scams, outages. Beginners often do not know where to start. Security teams use a small model to sort every problem into a few boxes. Once you know which box a problem is in, you know what kind of protection it needs.

The most common model is the CIA triad. A triad is a group of three. Here CIA has nothing to do with the American agency; the letters stand for Confidentiality, Integrity and Availability.

Confidentiality: only the right people can see it

Confidentiality means information is seen only by people who are allowed to see it. Your bank balance, your Aadhaar number, a company salary sheet and a patient report are all confidential. A data leak, a stolen laptop with an unencrypted disk, or a shared password all break confidentiality.

Tools that protect confidentiality: passwords and multi-factor authentication (proving who you are), access control (deciding who may open what), and encryption (scrambling data so only key holders can read it).

Integrity: the data is correct and unchanged

Integrity means data is accurate and has not been changed by someone who should not change it. If an attacker changes the account number on an invoice, or a student edits marks in a college database, integrity is broken even if nothing was leaked.

Tools that protect integrity: hashes (a fingerprint of data that changes if one bit changes), digital signatures, access control, audit logs that record who changed what, and backups to restore correct data.

Availability: it works when you need it

Availability means systems and data are ready when people need them. When a railway booking site is down at tatkal time, when ransomware locks every file in a hospital, or when a flood of fake traffic (a denial-of-service attack) knocks a website offline, availability is broken.

Tools that protect availability: backups, spare servers (redundancy), protection against traffic floods, patching, and good capacity planning.

Two more words you will hear

• Authenticity: proof that data or a person is genuine, for example that an email really came from your bank.
• Non-repudiation: the sender cannot later deny they sent something, because there is strong proof, such as a digital signature on a tax filing.

Common mistakes

• Thinking security means only confidentiality. A ransomware attack that leaks nothing but locks every file is still a serious incident (availability).
• Forgetting that one incident can hit more than one property. Ransomware gangs often steal data first (confidentiality) and then encrypt it (availability).
• Adding so much security that people cannot work. A system nobody can use has failed on availability. Good security balances all three.