The CIA Triad: Confidentiality, Integrity, and Availability

By: Joe Collier

                Cybersecurity is becoming more important as more of our personal and professional information is stored digitally. Organizations must think about more than just stopping hackers from getting into their systems. They also must make sure all information is accurate and the systems are available when needed. One of the models used to accomplish this is the CIA Triad. The CIA Triad stands for Confidentiality, Integrity, and Availability. These three principles work together to help organizations protect their information and systems. Authentication and authorization are also important to help control who has access to those systems and what they are allowed to do once they have access.

Confidentiality is about keeping information private and only allowing access to people who are supposed to have it. Fortinet explains that confidentiality requires organizations to control access to information so that data is not shared with unauthorized people, whether intentionally or accidentally (Fortinet,n.d.).

To an organization, confidentiality is important because they collect and

store information about employees and customers. If that information gets into the wrong hands it could lead to a host of problems. Organizations can protect the information by using encryption, strong passwords, multi-factor authentication, access controls, and training. Training is important because an employee can accidentally give an attacker access to the system through something as simple as a phishing email.

Integrity means making sure information stays accurate and is not changed without permission. It is important to be able to trust that information you are looking for is the same that was originally created and stored. Fortinet (n.d.) explains that data has integrity when it remains authentic, accurate, reliable, and free from unauthorized changes.

This is important because changing information can be just as damaging as stealing it. An example, imagine if someone gained access to a hospital system and changed medical and medication history. The information would still be there, but it no longer be trustworthy and could put someone’s life at risk

Availability means making sure systems and information are accessible when authorized users need them. Fortinet (n.d) explains that networks, systems and applications need to function properly so authorized users can access the information they need when they need it.

Availability can be affected by serval things such as hardware failure, power outages, natural disasters, denial-of-service attacks, and ransomware. Organization can improve availability by having backups, redundant systems, disaster recovery plans, and updates. Backups are important with ransomware because they can give the organization another way to recover its information instead of depending on the attacker.

Authentication and authorization may sound the same, but they have different purposes in cybersecurity. Authentication is proving that you are who you say you are. Something like logging into a computer or website with a username and password is a good example. Multi-factor authentication provides another layer of protection. It can do this by sending a code to your phone or an authentication app.

Authorization is what happens after your identity has been confirmed. It determines what information, files or systems you are allowed to access. An easy way to think about it is authentication proves who you are, while authorization determines what you are allowed to do. Both are very important.

An example of why the CIA Triad matters is the 2024 ransomware attack against Change Healthcare. Change Healthcare plays a major role in the US healthcare system by processing insurance eligibility, claims, prior authorizations, and payments. In February 2024 attackers connected to ALPHV/BlackCat ransomware group gained access to Change Healthcare’s network. According to Petrino (2026), the attackers entered through a remote access portal that did not have multi-factor authentication enabled.

This incident affected more than one part of the CIA Triad. Confidentiality was affected; attackers were able to steal large amounts of sensitive information. This included medical information, insurance information, billing information, personal identifiers, and some financial information. This breach affected and estimated 192.7 million people, making it the largest healthcare date breach in US History (Petrino, 2026)

Availability was also a problem. When Change Healthcare’s systems went offline, hospitals, pharmacies, doctors and insurance companies had trouble processing claims, payments and authorizations. This shows how one cyberattack can spread beyond the company that was attacked. According to Petrino (2026), 74 percent of hospitals responding to an American Hospital Association survey reported that the attack directly affected patient care, while 94 percent reported a financial impact.

One of the biggest things that stands out to me about this attack is how it started. Multi-factor authentication was not being used on the remote access portal the attackers used to enter the network (Petrino, 2026). Something as simple as an additional authentication method could have made it much harder for the attackers to gain access. This attack shows why cybersecurity is not just about responding after something happens, but finding and fixing weaknesses can save an organization and its customers much bigger problems later.

In conclusion, the CIA Triad is an important part of cybersecurity because it focusses on protecting information in three different ways. Confidentiality keeps information private and away from those who should not have access to it. Integrity makes sure that information stays accurate and is not changed without permission. Availability makes sure the system and information are accessible when they are needed. Authentication and authorization also work with these principles by making sure users are who they say they are and only have access to what is needed.

The Change Healthcare attack is a good example of what can happen when cybersecurity protections fail. The attack didn’t just affect the company, it affected hospitals, healthcare providers, pharmacies and millions of people whose personal information was exposed. Using multi-factor authentication, strong access controls, backups, training and regularly checking for weaknesses can help protect information and reduce damage caused by a cyberattack.

References

Chai, W. (n.d.). What is the CIA triad? Definition, explanation, examples. TechTarget.

Fortinet. (n.d.). What is the CIA triad and why is it important? Fortinet. https://www.fortinet.com/resources/cyberglossary/cia-triad

Petrino, G. (2026, July 8). Change Healthcare data breach: What happened, who did it, and what to do. Security.org. https://www.security.org/identity-theft/breach/change-healthcare

SCADA Systems: Cybersecurity and Critical Infrastructure

By: Joe Collier

SCADA stands for Supervisory Control and Data Acquisition and is an industrial process monitoring and control system. SCADA systems are used in places like power plants, water treatment facilities and other parts of vital infrastructure. The systems collects data from equipment and relays information to a central location where an operator can monitor what is happening. Remote Terminal Units (RTUs) gather information from the sensors, Programmable Logic Controllers (PLCs) control equipment in the field, and the communication system connects those devices back to the main system. The Human Machine Interface (HMI) is how the human operator sees the information and interacts with the system (SCADA Systems, n.d.).

SCADA systems are important because they are utilized in many of the services that we depend on every day. In the energy industry, SCADA can be used to monitor power generation, substations, and electrical transmission. Water systems can utilize it to monitor pumps, valves, pressure, flow, and water levels. The article presents an example of a PLC controlling the flow of cooling water while the SCADA system records and displays conditions such as high temperature or loss of flow (SCADA Systems, n.d.).

One cybersecurity risk with SCADA is unauthorized access. If someone was able to gain access to the HMI, PLC, RTU, host computer, or any other connected device, they would be able to change settings or interfere with the equipment. The article explains that unauthorized software access, viruses, and intentionally changed settings can affect the control host. It also explains that some SCADA devices may have little or no security at the packet control level (SCADA Systems, n.d.). This is a problem since an attacker may not just be looking at information. Depending on what they gain access to, they could possibly send commands to physical equipment.

One other issue is the amount of networking and remote communication used with modern SCADA systems. One of the things that makes SCADA helpful is the ability to monitor equipment from a distance. However, this also means there are more connections to be secure. Electrical4U says that SCADA systems use communication networks to connect remote equipment with the central system (Muthukrishnan, 2024). According to the article modern SCADA systems use standard networking technologies such as TCP/IP and can be connected through Internet-based platforms (SCADA Systems, n.d.). The more interconnected these systems are, the more critical it is to make sure that someone can’t utilize that connection to sneak into the system.

A cyberattack against a SCADA system could cause much larger problems than just stolen information. SCADA systems control or monitor physical processes, so an attack could affect services people depend on such as power and water. The article notes that SCADA systems are used to control things such as water distribution, traffic lights, electrical transmission, gas transportation, and oil pipelines (SCADA Systems, n.d.). If one of these systems was taken offline or controlled by an attacker, the organization could experience financial issues, safety issues, and service interruptions. Depending on the system, the entire community could be affected rather than just the organization that was hit.

Organizations can add multiple layers of protection to increase SCADA security. System access should be limited to those who require it. Remote connections should be secured. Organizations should also monitor alarms and system activity so that they can rapidly spot strange developments. Electrical4U discusses alarm supervision and management as an important part of SCADA software and points to the importance of choosing SCADA technology that can remain stable and secure over time (Muthukrishnan, 2024). Backups and redundant hardware are also important. The article explains that some critical SCADA installations use redundant hardware and communication channels so a backup can take over when something fails (SCADA Systems, n.d.).

Training is also crucial, because there’s still a human operating the system. A corporation may spend a lot of money safeguarding the technology, but an employee can still be targeted with phishing or another sort of social engineering. Strong passwords, multi-factor authentication, limiting user access, keeping systems up to date, and having an incident response plan can all help reduce the risk.

In conclusion, SCADA systems are the backbone of critical infrastructure, as they allow organizations to monitor and control industrial processes. They can gather data, alert workers to problems, and enable equipment to be controlled from a central location. At the same time, connecting physical equipment to computers and networks presents dangers for cybersecurity. Unauthorized access and network connections might provide attackers with possible methods into the SCADA system. The thing that really sticks out to me concerning SCADA security, is how a cyberattack could become a physical problem. Protecting these systems is not just about protecting data: it is also about keeping equipment running safely and making sure services like power, water, and other infrastructure are available when people need them.

References

Muthukrishnan, V. (2024, June 6). SCADA system: What is it? (Supervisory Control and Data Acquisition). Electrical4U. https://www.electrical4u.com/scada-system/

SCADA Systems. (n.d.). Supervisory control and data acquisition [Course article].

The Human Factor in Cybersecurity

By: Joe Collier

The human factor in cybersecurity refers to the role people play in protecting information or creating security risks. Technology alone won’t stop an employee from clicking on a phishing link, reusing a password, or misusing access, all of which can put a business in danger. Corporations need to understand why people make these decisions, rather than depending on technology.

The human factor is about the impact of our habits, choices, errors, and interactions with other people when using technology. Someone might open an attachment because it looks like it is from their boss or ignore security procedures because they’re eager to get their work done. Such activities may look insignificant, but they may allow an attacker access to sensitive information. According to Payne and Hadzhidimova (n.d.), cybersecurity needs both technical knowledge and an understanding of human behavior. That is crucial because network security is partly about understanding the people who use it.

Phishing is an example of how attackers can exploit human behavior. An email may appear to be from the IT department and inform an employee that their account will be disabled unless they log in now. The attacker uses fear, urgency, and trust to convince the employee to act without thinking. If the employee enters their information on a fake site, the attacker could gain access to the organization’s systems. Training employees to spot suspicious messages and verify requests through a reliable source can help avoid such risk.

Another common risk is the use of weak or reused passwords. People have so many accounts that they are tempted to use the same password for all of them. If an account is hacked, the attacker may try the same credentials on other accounts. Organizations can help by using multifactor authentication, password managers, and clear password policies. Organizations should make the secure option easier for employees to use rather than just telling them to be careful.

Not all cybersecurity incidents come from an outside attacker. An insider threat can be an employee who intentionally takes information or accidentally discloses information. Payne (2018) states cybercrime and white-collar crime can overlap when people use workplace technology to commit an offense. An employee with access to client records could copy the information for personal gain. If the employee already has access, the organization needs to consider how that access is used.

Workplace culture can also affect those decisions. Payne and Hadzhidimova (n.d.) discuss neutralization theory, which explains how offenders may rationalize their actions by denying the harm or blaming the victim. This does not excuse the behavior but helps explain why cybersecurity is a social issue. Organizations should also restrict employees’ access to only what they need, look for suspicious activities, and make sure staff are aware of the consequences of misusing information.

Cyber risks are constantly evolving, so ongoing training and communication are key to mitigating such risks. Employees need to know how to identify phishing, how to protect their credentials, and how to report something suspicious. Training should involve real world examples rather than having employees complete a yearly checklist. Managers are also subject to the same policies they expect everyone else to follow.

Routine activity theory also helps to explain why prevention is important. Payne and Hadzhidimova (n.d.) state, crime can occur when a motivated offender, a suitable target, and the absence of a capable guardian come together. Cybersecurity protection can be provided through monitoring, control of access, training, and personnel who report suspicious activity. We should aim to remove opportunities for attack while also helping people make better decisions.

In conclusion, the human factor is a key part of cybersecurity, as people can be a source of vulnerabilities or help prevent them. Phishing, weak passwords, and insider threats, all show how  human choices can impact an entire organization. Technology is important, but it cannot solve every problem on its own. The combination of security tools with training, clear policies, communication, and a positive workplace culture can help organizations better safeguard their information and lower the risk of cyber incidents.

References

Payne, B. K. (2018). White-collar cybercrime: White-collar crime, cybercrime, or both? Criminology, Criminal Justice, Law & Society, 19(3), 16–32.

Payne, B. K., & Hadzhidimova, L. (n.d.). Cybersecurity and criminal justice: Exploring the intersections. International Journal of Criminal Justice Sciences. (Course materials).