The CIA Triad
William S. Link
Department of Cybersecurity, Old Dominion University
CYSE 200T: Cybersecurity, Technology, and Society
Prof. Charles E. Kirkpatrick
September 14, 2025
2
BLUF
Authentication and authorization are similar concepts that work together to protect
information. However, Authentication is about identifying a user using real-life elements,
while authorization is about what the system lets the user access once identified.
Background
The CIA Triad, comprising Confidentiality, Integrity, and Availability, is a widely accepted
model that guides the development of information security policies. These policies must
be implemented to ensure the security and integrity of all data. Security teams can
separate problems into these three fields to assess problems within the system. The
triad benefits the cybersecurity community by simplifying the process of threat detection
and prioritizing defenses. The role of confidentiality is to ensure information is only
accessible by authorized individuals. Privacy policies and encryption are confidential
systems. Integrity ensures data is accurate and trustworthy. File permissions and user
access controls (Chai 2022) are tools used to prevent data corruption. Finally,
Availability is the user’s ability to access a service when needed. Systems can
malfunction at any time, but some are too important to be down for an extended period.
Safeguards such as backup power supplies and cloud storage are key to restoring
systems with minimal to no damage or loss of data.
3
Authentication vs. Authorization
Authentication and Authorization are not part of the CIA triad, but they still heavily relate
to cybersecurity policies and should be taken into account when addressing security
systems. While they are similar concepts, Authentication is the process of identifying a
user. For example, users may be required to use Touch or Face ID to access certain
information. Authorization is the process of determining what information a user is
allowed to access now that he has been identified. For example, if two brothers share a
console and one logs into his account, he will be able to see his own information, but his
brother’s data will be locked behind his account password.
4
References
Chai, W. (2022, June 28). What is the CIA Triad? Definition, Explanation, Examples. Google
Drive. https://drive.google.com/file/d/1898r4pGpKHN6bmKcwlxPdVZpCC6Moy8l/view
Fortinet. (2025). Authentication vs Authorization: Key Differences. Fortinet CyberGlossary.
https://www.fortinet.com/resources/cyberglossary/authentication-vs-authorization
Fortinet. (2025). What is the CIA Triad? And Why is it Important? Fortinet CyberGlossary.
https://www.fortinet.com/resources/cyberglossary/cia-triad
Fruhlinger, J. (2024, July 12). What is the CIA triad? A principled framework for defining infosec
policies. CSO Online.
https://www.csoonline.com/article/568917/the-cia-triad-definition-components-and-exam
ples.html
SCADA Systems
William S. Link
Department of Cybersecurity, Old Dominion University
CYSE 200T: Cybersecurity, Technology, and Society
Prof. Charles E. Kirkpatrick
November 9th, 2025
2
BLUF
Supervisory Control and Data Acquisition (SCADA) systems provide many benefits to the
industrial industry. However, these systems come with new vulnerabilities since being connected
to the interent that must be addressed by enforcing strict access controls, minimizing third-party
exposure, and conducting regular cybersecurity training to prevent a possible crisis from the
temporary loss of resources
Background
Supervisory Control and Data Acquisition (SCADA) systems refer to industrial systems used to
manage infrastructure, industrial, and facility-based processes. Most SCADA systems consist of
five elements:
1. Human-controlled apparatus where all processed data is presented
2. A supervisory system that collects required data while executing tasks
3. Remote Terminal Units (RTUs) convert signals into digital data that is sent to the
supervisory system
4. Programmable Logic Controller
5. Communication Infrastructure to connect RTUs to the supervisory system
3
Most actions are carried out automatically by the RTUs, while the supervisory system monitors
the task for any interference. This data is then forwarded to the apparatus, where the operator
can make executive decisions using the machine interface. The structure of SCADA systems is
designed to minimize loss of life and resources from control system failures by using redundant
hardware that immediately identifies and replaces a failed component.
Vunerablities
While the use of SCADA systems provides many benefits, it is important to understand the
value and risks associated with these systems and decide on the best ways to keep them
secure. SCADA systems have two primary threats: the first being unauthorized access of
malicious software, which is a threat to any device connected to a network. To prevent this,
systems should implement access restrictions, minimize the use of third-party vendors without
clear security agreements, and conduct regular cybersecurity training to enforce safe practices
in the work environment. The second major threat to SCADA systems is the lack of security on
packets. Anyone who sends packets to an SCADA device is able to control it. Some use a VPN
for protection, but better security is required for such valuable assets. Because SCADA systems
handle such important tasks as water distribution and electricity transmission, they are prime
targets for cyberterrorism attacks. People rely on these resources to meet their daily needs, so
they must be kept as secure a possible
The Human Factor in Cybersecurity
William S. Link
Department of Cybersecurity, Old Dominion University
CYSE 200T: Cybersecurity, Technology, and Society
Prof. Charles E. Kirkpatrick
November 16, 2025
2
BLUF
As Chief Information Security Officer, I would respond to the predicted rise in cybercrime
by prioritizing security and minimizing vulnerabilities within my company. With human
error being a large factor in cyber breaches today, it must be addressed to keep
systems secure. To maximize security with the human factor in mind, I would break our
budget into three ways. Technical Security (60%), Security Training (30%), and
Monitoring and Governance (10%).
Background
It is important to account for the human aspect when managing a cybersecurity system.
A sizable fraction of cyberattacks are made possible by human error and poor security
practices. These attacks have detrimental consequences to multiple parties and can be
easily avoided by implementing proper training for required to be completed regularly by
each employee to promote a secure and responsible work environment. While healthy
practices are effective, they will not be enough to ensure the safety of sensitive data.
Up-to-date security technology will be our primary defense against cyber attacks.
Having secure and redundant systems provides technical protection to complement the
physical protection.
Spending Allocations
To ensure that each area of our security system is adequately funded, I suggest these
spending allocations for each area. 60% of our budget should go into Technical
3
Security. This is the most important and strongest line of defense and should be made
a top priority. 30% of our spending should go towards Security Training. Employees
must participate in regular training to minimize the chance of human error when
handling sensitive data. Finally, the last 10% of our budget should go to Monitoring
and Governance. While protecting from outside threats, we must also review our own
systems frequently to ensure all is in order
References
4
References
CyberPaul. (n.d.). Using SCADA to protect critical infrastructure and systems. Retrieved from
https://cyberpaul (originally derived from http://www.scadasystems.net)
Amos, Z. (2025, October ?). 9 SCADA system vulnerabilities and how to secure them. ISA GCA
Blog. Retrieved from
https://gca.isa.org/blog/9-scada-system-vulnerabilities-and-how-to-secure-th