M01-01 · The CIA triad

The first concept in the new morning route: the CIA triad.

1. Plain-language definitions

• Confidentiality: only authorized people can obtain the information.
• Integrity: information is not improperly modified or destroyed.
• Availability: information and services can be accessed in a timely, reliable way when needed.

2. Uses and conditions

When assessing a system, first ask what needs protection, who may use it, and when it must be available. Then choose controls. The relative importance of the three goals depends on the business context; equal weighting is not appropriate for every system.

3. One connected example

In the fictional Northstar learning platform, a stranger reading students' private answers is a confidentiality problem; unauthorized grade changes are an integrity problem; an outage during an exam is an availability problem. One incident can harm several goals: ransomware may make data unavailable and may also steal it first.

4. Defenses and evidence

Access control and encryption can help protect confidentiality. Change review, comparison against trusted hashes, or digital signatures can help check integrity. Redundancy, capacity planning, and actual restoration tests can help maintain availability.

But HTTPS does not prove that authorization is correct. Having a backup does not prove that restoration will work. Matching hashes do not establish that the original data was correct. Keep controls and verification evidence separate.

5. Quick check

A grade file has not leaked or been changed, but the teacher cannot open it at all before the submission deadline. Which goal is primarily affected? What evidence would you seek to confirm this?

References: NIST confidentiality, integrity, and availability.