Riley Copeland | September 5, 2026
The CIA Triad
Almost everything in cybersecurity traces back to three goals: keep information private, keep it
accurate, and keep it reachable. Those three get shortened to the CIA Triad which stands for
confidentiality, integrity, and availability. It is a simple framework that’s been around since the
late 1990s because every organization pays for protecting at least one of the three. This paper
covers what each piece actually means, where authentication and authorization fit in, and what
happens when one of these goals gets neglected.
What Each Part Means
Confidentiality is the privacy side. Making sure the only people reading a piece of information
are the people who are supposed to be reading it. Could be lots of things like a customer’s
Social Security number or a company’s internal budget. Integrity is about whether the data can
be trusted. If a record has been changed, deleted, or corrupted, whether by an attacker, a distracted employee. Availability means authorized users can actually get to their systems when they need them. A network that is locked down so tightly that nobody can use it is not secure, it is just useless (Hashemi-Pour & Chai, 2023). Each goal can fail in its own way, which is why all three are worth tracking separately. A confidentiality failure turns into identity theft and lost customers. An integrity failure means decisions get made on bad information, which is a serious problem for a hospital reading a medication record or a bank reading an account balance. An availability failure would shut down the business, which is exactly what ransomware is designed to cause. These goals sometimes work against each other. For example, every extra authentication step makes a system a little more confidential and a little harder to reach in a hurry, so security teams end up balancing the three instead of maximizing any one of them (Hashemi-Pour & Chai, 2023).
Authentication vs Authorization
These two get used interchangeably, but they answer different things. Authentication means
“are you who you claim to be” through a password, a fingerprint, or a code texted to a phone.
Authorization means “what are you allowed to touch” and it only happens after authentication
succeeds. In a hospital, a nurse and a billing clerk both log in with their own accounts, so both
are authenticated. But the nurse is authorized to open patient charts and the clerk is not, since
the clerk only needs payment records. Authentication proves identity, and authorization keeps
that identity boxed into what it needs
Real-World Example
The Equifax breach is worth looking at because the attackers did not do anything special. They
got in through a known bug in Apache Struts, the web software Equifax used to run part of its
site. A fix for that bug came out in March 2017 which was months before breach, but Equifax
never installed it. The attackers moved around the network for months without anyone catching them. Part of the reason was that a certificate Equifax needed to check its own encrypted traffic had expired and nobody renewed it for almost a year (Winder, 2019; GovInfoSecurity, 2020). About 147.9 million Americans had their information stolen, including Social Security numbers, birth dates, and driver’s license numbers. Around 209,000 people also had credit card numbers taken (Winder, 2019). For the victims, a stolen Social Security number cannot be reset the way a password can, so the identity theft risk follows them indefinitely. For Equifax, the bill was a settlement of up to $700 million split among the FTC, the CFPB, and nearly every state, the largest of its kind at the time, plus the reputation damage and years of litigation (Winder, 2019).
How to Prevent
None of the fixes are exotic. Preventative maintenance goes a long way. A patch management
process, with someone accountable for tracking the vulnerabilities and pushing updates on a
schedule. Segmentation and traffic monitoring make it harder to reach dozens of databases and
shorten the time an intruder goes undetected. Encrypting data at rest makes stolen files less
useful, and tight authorization limits how far one compromised account can go.
Conclusion
The CIA Triad keeps security from collapsing, since confidentiality, integrity, and availability each cover a different way things break. Authentication and authorization support all three by controlling who gets in and what they can do afterward. Equifax is an example that the failure is usually not a sophisticated attack. It is a patch nobody installed.
References
GovInfoSecurity. (2020, January 14). Equifax settles mega-breach lawsuit for $1.38 billion. https://www.govinfosecurity.com/equifax-settles-mega-breach-lawsuit-for-138-billion-a-
13608
Hashemi-Pour, C., & Chai, W. (2023, December 21). What is the CIA triad (confidentiality,
integrity and availability)? TechTarget. https://www.techtarget.com/whatis/definition/Confidentiality-integrity-and-availability-
CIA
Winder, D. (2019, July 22). Equifax to pay up to $700 million in data breach settlement.
TechTarget. https://www.techtarget.com/cybersecurity/news/252467172/Equifax-to-pay-up-to-700-
million-in-data-breach-settlement