Pageof 3

Ethan Junke
The CIA Triad
BLUF
The CIA Triad stands for confidentiality, integrity, and availability. These three ideas are
important because they help organizations protect their information and computer
systems. Confidentiality keeps information away from people who should not have it.
Integrity makes sure information stays correct and is not changed without permission.
Availability makes sure authorized users can access information and systems when
they need them. Authentication and authorization also help with security by making sure
users are who they say they are and only have access to what they are allowed to use.
Confidentiality, Integrity, and Availability
The CIA Triad is one of the basic ideas used in cybersecurity. It gives organizations a
way to think about how they should protect their information and systems (Chai, 2022).
Confidentiality means keeping information private and making sure only authorized
people can see it. For example, a patient’s medical records should not be available to
everyone in a hospital. Only people who need the information to do their jobs should be
able to access it. Some common ways to protect confidentiality include passwords,
encryption, multifactor authentication, and access controls. Chai (2022) explains that
encryption and two-factor authentication are examples of ways organizations can
protect sensitive information.

Confidentiality is important because stolen information can cause serious problems. If
an attacker gets someone’s Social Security number, banking information, or passwords,
that information could be used for identity theft or financial fraud. Businesses also have
to protect customer information because losing private data can damage their reputation
and result in legal or financial problems.
Integrity means making sure information stays accurate and trustworthy. Information
should not be changed by someone who does not have permission to change it. For
example, if a bank account shows that someone has $1,000, an attacker should not be
able to change the balance to $10,000. Organizations can help protect integrity by using
access controls, file permissions, backups, logs, checksums, and version control (Chai,
2022).
Integrity is important because incorrect information can be just as harmful as stolen
information. In healthcare, for example, changing a patient’s medical information could
lead to the wrong treatment. In a business, changing financial records could result in
incorrect payments or other financial problems.
Availability means making sure authorized users can access information and systems
when they need them. For example, an employee should be able to access the
company’s systems during working hours. A customer should also be able to access an
online banking website when they need to check their account.
Availability can be protected through backups, system maintenance, redundancy,
monitoring, and disaster recovery plans. Chai (2022) explains that organizations can
use backup systems, failover systems, and disaster recovery plans to reduce downtime.

All three parts of the CIA Triad are important. An organization could have strong
confidentiality but still have a security problem if its systems are unavailable. The goal is
to protect information while also making sure it stays accurate and accessible to the
people who need it.
Authentication and Authorization
Authentication and authorization are related, but they are not the same thing.
Authentication is the process of checking someone’s identity. A simple example is
logging into an account with a username and password. Multifactor authentication adds
another step, such as entering a code from an authentication app. This makes it harder
for someone to access an account even if they have stolen the password. NIST defines
authentication as verifying the identity of a user, device, or other entity (National Institute
of Standards and Technology [NIST], n.d.-a).
Authorization happens after authentication. It determines what an authenticated user is
allowed to access or do. For example, an employee may be allowed to log into a
company’s network but may not be allowed to access the company’s payroll records. A
manager or system administrator may have permission to access those records
because their job requires it. NIST describes authorization as the process of
determining access privileges for users or other entities (NIST, n.d.-b).
A simple way to remember the difference is that authentication asks, “Who are you?”
while authorization asks, “What are you allowed to do?” Both are important for
protecting confidentiality