CIA Triad (Confidentiality, Integrity, Availability)
Part of the Cybersecurity Roadmap
In short
Every security decision you'll ever make protects one of three things: secrets stay secret, data stays correct, and systems stay up. Learn these three words and every attack starts to make sense.
The foundational model for security goals — Confidentiality (only authorized access), Integrity (data isn't tampered with), Availability (systems stay usable) — every security control exists to protect one or more of these.
Think of it like this
Your bank locker
Only you hold the key, so nobody else sees your gold (confidentiality). The seal shows nobody swapped anything (integrity). And the bank must be open when you need it (availability). A locker that fails any one of these is useless.
Watch it happen
Three goals, and how each one gets broken
1/5Every security control protects at least one of these three goals.
The big ideas
What you need to know
Confidentiality
Only the right people can read the data. Tools: encryption, access control, MFA.
Integrity
Data isn't changed by anyone who shouldn't. Tools: hashes, digital signatures, audit logs.
Availability
The system works when people need it. Tools: backups, redundancy, DDoS protection.
They pull against each other
Locking things down too hard can hurt availability. Good security finds the balance for each system.
Save yourself the pain
Common mistakes
Oops
Thinking security only means keeping things secret.
Do this instead
Integrity and availability matter just as much. A hospital system that's down can hurt more people than a leak.
Oops
Treating every system the same.
Do this instead
A public blog cares most about availability. A payroll database cares most about confidentiality. Rank them per system.
Your mission
Triad-tag the news
Quick check
An attacker quietly changes the bank account number on a company's vendor invoices. Which goal is mainly broken?
Go deeper
- 1Classify 5 real security controls (encryption, backups, access control) by which CIA element they primarily protect.
- 2Identify a real incident type that primarily violates availability (e.g. a DDoS attack) versus confidentiality (e.g. a data breach).
- 3Learn why some controls trade off against each other — extreme confidentiality controls can hurt availability.
More topics at this stop
What Cybersecurity Professionals Actually Do
Types of Security Roles (SOC Analyst, Pentester, GRC, AppSec)
Common Attack Vectors Overview
Threat Actors & Motivations
A Day in the Life of a Security Analyst
The Cybersecurity Career Ladder
Key Domains Overview (Network, App, Cloud, GRC)
Security Certifications Landscape (Overview)
Stuck on this topic? Ask an Insider
Get 1:1 guidance from people who've walked this exact path — on the InsideEdge app.
