Cyniah Dunlap
Old Dominion University
CYSE 201: Cybersecurity
Charlie Kirkpatrick
September 9, 2026
CIA Triad and Cybersecurity Fundamentals

Cybersecurity, we all need it! It’s a topic that many people think they understand, but in reality, there is a much bigger picture beneath the surface that often goes unnoticed. Cybersecurity is important because organizations store and use a lot of information that needs to be protected. This can include personal information, financial information, medical records, passwords, and other important data. All the things we hold most dear to us needs to be protected. One of the main concepts used to understand information security is the CIA Triad. The CIA Triad stands for confidentiality, integrity, and availability. These three areas work together to help organizations protect information and keep their systems working properly. Authentication and authorization are also important because organizations need to know who is accessing a system and what that person is allowed to do.
Confidentiality basically means making sure information is only available to people who are supposed to have access to it. In simple terms, it is about keeping private information private. For example, a patient’s medical records should not be available for just anyone in a hospital to look at. Only employees who actually need the information for their job should be able to access it, not a regular ol joe. The Chai article explains that organizations can protect confidentiality through practices such as authentication, two-factor authentication, encryption, and limiting where sensitive information is stored or transmitted.
Confidentiality is important because a security breach can expose information that could seriously affect people or an organization. If someone’s Social Security number, medical information, or financial information is exposed, that information could potentially be used for identity theft or other harmful purposes. Strong passwords, two-factor authentication, encryption, employee training, and limiting access are some ways organizations can lower this risk.
Integrity is about making sure information stays accurate and trustworthy. It means that information should not be changed, deleted, or manipulated by someone who is not supposed to change it. For example, if a hospital has a patient’s medication information in its system that information needs to remain correct. If someone changed the medication information without permission, it could potentially put the patient in danger. Integrity is important because having information is not enough if the information can’t be trusted, at that point it’s just useless. The Chai article explains that organizations can use access controls, file permissions, version control, checksums, backups, and digital signatures to help protect integrity. These tools can help prevent unauthorized changes, detect changes, and recover information if something goes wrong.
Availability means that authorized users can access information and systems when they actually need them. A system could have strong confidentiality and integrity, but it would still be a problem if employees could not access it when they needed to. For example, if a hospital’s computer system goes down, employees may have trouble accessing patient information, processing payments, or completing other important tasks.
Availability is important because organizations depend on their technology to keep their everyday operations going. The Chai article explains that organizations can improve availability through maintenance, capacity management, redundancy, failover systems, backups, disaster recovery plans, and network protection. These practices give organizations ways to continue operating or recover when a system fails or is attacked.
One real-world example that shows why the CIA Triad matters is the 2024 Change Healthcare cyberattack. Change Healthcare, a healthcare technology company owned by UnitedHealth Group, experienced a ransomware attack in February 2024. The attack caused major disruptions to healthcare organizations because many systems that depended on Change Healthcare were affected. The Centers for Medicare & Medicaid Services said the incident was affecting healthcare operations across the country and raised concerns about disruptions to care and payments to healthcare providers.
The attack also involved confidentiality because protected health information was breached. The Department of Health and Human Services reported that Change Healthcare filed a breach report stating that the ransomware attack resulted in a breach of protected health information. This means that the incident was not only about systems being unavailable. There was also a risk to people’s private medical information.
The attack had a major impact because healthcare providers rely on computer systems to perform basic parts of their jobs. When those systems were disrupted, healthcare organizations had problems with things such as submitting claims and receiving payments. This shows how availability can affect much more than just whether a website works. If important systems are unavailable, it can affect employees, organizations, patients, and the overall ability to provide services.
There are several cybersecurity practices that could help reduce the chances and impact of similar attacks. Organizations should use multi-factor authentication, strong access controls, regular system updates, employee cybersecurity training, network monitoring, and reliable backups. Backups are especially important because they can give an organization a way to restore information after ransomware or another type of attack. The Chai article also explains the importance of redundancy and disaster recovery because organizations need a plan for continuing operations when systems are disrupted.
Another important part of cybersecurity is understanding the difference between authentication and authorization. Authentication is basically proving who you are. NIST defines authentication as verifying the identity of a user, process, or device before allowing access to resources. A simple example would be logging into a school account using a username, password, and possibly a verification code. The system is checking that the person logging in is actually the person connected to that account.
Authorization happens after authentication and determines what that person is allowed to access or do. NIST describes authorization as the access privileges granted to a user, program, or process. For example, a student might successfully log into a university system, but that does not mean the student can access another student’s grades. The student is authenticated because the system knows who they are, but authorization determines what information they have permission to access.
The easiest way I think about the difference is authentication asks “Who are you?” while authorization asks “What are you allowed to do?” Both are important to cybersecurity. Authentication helps prevent people from pretending to be someone else, while authorization helps prevent users from accessing information or functions they do not need. This also connects back to confidentiality because organizations should limit access to sensitive information.
Overall, the CIA Triad gives organizations a way to think about the main things they need to protect. Confidentiality keeps information from being seen by the wrong people, integrity keeps information accurate and trustworthy, and availability makes sure authorized users can access information when they need it. Authentication and authorization add another layer by verifying users and controlling what they can access. The Change Healthcare attack shows that cybersecurity problems can affect both private information and an organization’s ability to operate. Because of this, organizations need multiple security measures working together instead of relying on just one type of protection.








References
Chai. (n.d.). CIA triad: The three requirements for information security. Course reading.
National Institute of Standards and Technology. (n.d.). Authentication. NIST Computer Security Resource Center. NIST Authentication Glossary
National Institute of Standards and Technology. (n.d.). Authorization. NIST Computer Security Resource Center. NIST Authorization Glossary
U.S. Department of Health and Human Services. (2024). Change Healthcare cybersecurity incident frequently asked questions. HHS Change Healthcare Cybersecurity Incident FAQ