What Is the CIA Triad?
The CIA triad names the three goals behind every security control: confidentiality (keep data secret), integrity (keep it correct), and availability (keep it reachable). Nearly any attack can be described as violating one of the three, and nearly any defense as protecting one — which makes the triad the field’s most useful first lens.
What does each part of the triad mean?#
Confidentiality is about disclosure: only authorized parties can read the data. Encryption, access control, and the same-origin policy all serve confidentiality.
Integrity is about correctness: data cannot be altered by unauthorized parties, and unauthorized changes are detectable. Hashing, digital signatures, and input validation serve integrity. A SQL injection that rewrites a balance is an integrity violation.
Availability is about access: the system is usable when legitimate users need it. Redundancy, backups, and DDoS mitigation serve availability. Ransomware attacks availability directly.
Why do the three goals trade off against each other?#
Because strengthening one often costs another. Consider the tension:
| Move | Helps | Can hurt |
|---|---|---|
| Encrypt everything, gate access tightly | Confidentiality | Availability (lost keys, friction) |
| Keep many redundant backups | Availability | Confidentiality (more copies to protect) |
| Add strict integrity checks that reject on doubt | Integrity | Availability (false rejections) |
Good security is not maximizing all three — it is choosing the right balance for this system, informed by a threat model.
The triad is the vocabulary the rest of the Security Fundamentals hub builds on. Pair it with least privilege and defense in depth for a working mental toolkit.
Frequently asked questions#
What does the CIA triad stand for?
Confidentiality, Integrity, and Availability — the three properties security controls exist to protect. Confidentiality keeps data secret, integrity keeps it correct and unaltered, and availability keeps it reachable when needed. Almost every control maps to one or more of these three goals.
Can the three goals conflict?
Yes, constantly. Encrypting and access-gating data raises confidentiality but can reduce availability; aggressive backups aid availability but create more copies to keep confidential. Security is largely the work of balancing these three against each other for a given system and its risks.
Is the CIA triad outdated?
It is a model, not the whole map, and some add properties like authenticity and non-repudiation (the Parkerian hexad). But as a first lens for classifying what a control protects and what an attack threatens, the triad remains one of the most useful tools in security.