# What is the CIA Triad?
The CIA Triad is the bedrock security model designed to guide organizational security policies, risk management, and system architecture.
It consists of three foundational pillars: Confidentiality, Integrity, and Availability. Every cybersecurity control—from encryption algorithms to redundant power supplies—is designed to protect one or more of these principles.
# 1. Confidentiality
Confidentiality ensures that sensitive information is accessible only to authorized entities and kept hidden from unauthorized individuals, processes, or devices.
Common threats against confidentiality include eavesdropping, shoulder surfing, unauthorized database queries, credential leaks, and man-in-the-middle packet sniffing.
- Encryption at Rest: AES-256 for hard drives, databases, and backup media.
- Encryption in Transit: TLS 1.3 for web and API traffic, SSH for remote server management.
- Access Controls: Least privilege, Role-Based Access Control (RBAC), and Multifactor Authentication (MFA).
# 2. Integrity
Integrity guarantees that data and systems remain accurate, complete, trustworthy, and unmodified by unauthorized parties or accidental corruption.
If an attacker alters financial balances in a banking database or injects backdoor code into an open-source software release, integrity has been catastrophically compromised.
# Generate file hash
sha256sum critical_kernel_update.tar.gz
# Output:
# 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 critical_kernel_update.tar.gz# 3. Availability
Availability ensures that systems, services, applications, and data are promptly accessible to authorized users whenever required.
A system that is perfectly encrypted and immune to tampering is useless if legitimate users cannot access it due to power loss, server crashes, or Denial of Service (DoS) floods.
Distributed Denial of Service (DDoS) attacks, ransomware encryption of critical databases, physical server disasters, and unpatched configuration bugs directly threaten availability.
# Balancing the Triad in Practice
In real-world security engineering, you must often balance trade-offs among the three principles depending on system requirements:
| System Type | Priority Pillar | Design Rationale |
|---|---|---|
| Banking & Healthcare | Confidentiality & Integrity | Patient records and financial balances cannot be leaked or corrupted. |
| Emergency 911 / Military Comms | Availability | Uptime is critical to save human lives; failovers must be instantaneous. |
| Public Weather / News | Availability & Integrity | Content is public, but must be accurate and always online. |
# Summary & Key Takeaways
Effective security architecture never relies on a single pillar in isolation. By applying the CIA triad in threat modeling, engineers ensure balanced protection against data theft, unauthorized modification, and crippling downtime.