The CIA Triad: what is it?
The CIA Triad remains an important cybersecurity model because it provides organizations with three fundamental goals for protecting their information and systems: confidentiality, integrity, and availability.
Confidentiality focuses on preventing unauthorized users from accessing information; integrity ensures that information remains accurate and unchanged; and availability ensures that authorized users can access information and systems when needed. Together, these three principles provide a simple framework that organizations can use when making cybersecurity decisions (Chai, 2022).
Authentication and authorization are how we identify users and their permissions. This essay will examine each component of the CIA Triad and explain how failures in any of these components can negatively impact an organization, as well as what authentication and authorization are and the difference between them.
Confidentiality
Confidentiality means keeping something private. Confidentiality measures are made and designed to protect data from individuals who should not be able to access it. Data is usually categorized depending on the amount of damage that could be caused if that information were released or stolen (Chai, 2022).
There are many ways that confidentiality can be compromised. These may involve direct attacks to gain access to a system. Confidentiality is crucial in an organization as it ensures sensitive data stays private. An example of a direct attack is a man-in-the-middle (MITM) attack, where the attacker places themselves between the sending and receiving ends of information and intercepts the data to steal or alter it.
There are multiple ways to fight against confidentiality breaches; examples include classifying and labeling restricted data, enabling access control policies, encrypting the data, and enabling and using multi-factor authentication (MFA) systems (Fortinet, n.d.).
Integrity
Integrity involves maintaining the consistency, accuracy, and trustworthiness of data over its entire lifecycle. When data is sent and received, it has to travel through servers and through the internet. In that timeframe, it can be intercepted and altered by an unauthorized user, and there are important steps to be taken to ensure that the data cannot be altered by unauthorized people (Chai, 2022).
Cybersecurity experts may implement access levels, enable tracking when making changes, and protect data when transferring or storing it (Coursera Staff, 2026).
For an organization, integrity is crucial because it ensures its data is accurate and trustworthy. An example of integrity is that, when sending an email, every single bit of information has to stay intact. If anything gets altered from the time the email is sent and received, the data has lost its integrity.
Availability
Availability refers to the idea that authorized users have access to the data when they need it, without affecting its confidentiality or integrity. This is achieved by ensuring proper maintenance of hardware and technical infrastructure, and the systems that hold and display the information (Chai, 2022).
To ensure availability, organizations can use redundant networks, servers, or applications. This way, in case the primary system has been disrupted, the data can still be accessed (Fortinet, n.d.). Availability is just as important as the other two.
An example of availability was the incident with the emergency number back in 2023 in the UK. On Sunday, June 25, 2023, a software issue caused a major outage in the UK’s 999 emergency call service, which lasted over 10 hours, and nearly 10,000 call attempts failed (Department for Science, Innovation & Technology & Cabinet Office, 2024).
The impact this had on the nation was significant, as access to 999 was delayed and risked delaying access to emergency assistance. The impact of this incident could have been reduced by implementing a resilient failover automation system.
Authentication & Authorization
When giving access to certain documents, it is necessary to know who the person accessing it really is. There are two processes, called authentication and authorization. Authentication is how a person proves that they are who they say they are. However, that alone doesn’t grant access; they still need to determine if that person is allowed to access the information or system, which is what authorization is (IBM, n.d.).
The airport security example is my favorite one. When going to the airport, you get asked for two things: your ID (authentication), but you also need proof that you are allowed onto the plane, with a boarding pass (authorization).
Conclusion
The CIA Triad is more than just a framework. By applying the CIA Triad to a company’s security strategy, it is possible to proactively strengthen security. With authentication and authorization, we can ensure we are able to give access to the right people. Without these systems in place, users and organizations would be at constant risk of attacks, which is why it is extremely important to have proper security in place.