Introduction
The CIA Triad is a guideline for cybersecurity practices within an organization and consists of the key principles of confidentiality, integrity, and availability. Confidentiality pertains to who is able to access the data by limiting it to authorized personnel. Integrity is the protection of data from unauthorized modification and ensuring it is in its correct state. Availability regards the accessibility of data when necessary. Using these concepts as a baseline, specialists can ensure vital data is handled appropriately (Chai, 2022).
Components of CIA Triad
To ensure the confidentiality of information, usually some form of authentication is used to determine if the user is who they say they are. This authentication includes passwords and security questions; however, proper education on basic cybersecurity measures is also usually necessary. Confidentiality is important because otherwise, anybody would be able to access sensitive data that can be used for exploitation (Chai, 2022).
Integrity is ensuring that the data is legitimate and protected from unauthorized modification. This concept includes authorization, version control, and constant verification of the data. Authorization is what each user is allowed to do to a piece of information. One user may be allowed to only view the information, whereas another may be allowed to also rewrite the information. Version control and constant verification can help when the data has been altered and needs to be restored by reverting to a previous state or rerequesting the data if it has arrived in an incorrect state. Integrity is important because incorrect data can lead to severe damage or exploitation by someone who has authorized access (Chai, 2022).
Availability is ensuring the data is accessible readily through proper maintenance of systems. This portion requires rigorous monitoring of systems and keeping them up-to-date. Any issues that arise should have plans in place to restore and protect them. This includes creating backups of data and providing proper bandwidth for data transfer. Availability is important because it ensures all systems have proper measures in place to ensure systems do not go down. This can prevent malicious attacks preventing data access and ensuring convenient access for users (Chai, 2022).
Real-world Examples
An instance in which CIA Triad principles were not properly maintained is Change HealthCare’s data breach in 2024. The data breach occurred because of a lack of multi-factor authentication on a remote access portal. This enabled the perpetrator to extract patient information which later appeared on the dark web. This remote access portal was an artifact existing prior to the acquisition of this company by the UnitedHealth Group. This clearly demonstrates an oversight on confidentiality and improper authentication practices, especially considering the sensitivity of the information involved (Petrino, 2026).
Preventative measures UnitedHealth Group could have taken to prevent this data breach mostly involve reviewing utilized services. Proper authentication should be required across all systems and by leaving a single door open, a user was able to exploit the system. Before the acquisition, Change HealthCare needed to properly vet how they were using external systems and review services that have direct access to sensitive data. Following the acquisition, UnitedHealth Group needed to properly overhaul the system to ensure insecure legacy systems were updated properly to meet cybersecurity guidelines and standards.
Conclusion
Overall, confidentiality, integrity, and availability are important for the protection and access of data. As seen in the instance with Change HealthCare, failing to properly incorporate those concepts when designing a system can introduce vectors for exploitation. To mitigate risks, it’s important to adhere to the CIA Triad when designing a system. By adhering to its principles, preventative measures are developed in parallel, limiting the gaps for malicious users.
Citations
Chai, W. (2022, June 28). What is the CIA triad? Definition, explanation, examples. TechTarget. https://www.techtarget.com/whatis/definition/Confidentiality-integrity-and-availability-CIA
Petrino, G. (2026, July 8). UnitedHealthcare data breach: A guide to UnitedHealth Group’s major incidents. Security.org. https://www.security.org/identity-theft/breach/unitedhealthcare/