CIA triad

The CIA triad names the three properties that security controls exist to protect. NIST's FIPS 199 uses the same three security objectives to categorize information systems by how much harm their loss would cause.

• Confidentiality: only authorized people and systems can read the information. Encryption, access control and data loss prevention protect it; a leaked customer database breaks it.
• Integrity: information is accurate and has not been changed by anyone who should not change it. Hashes, digital signatures and change control protect it; a tampered invoice or a modified log breaks it.
• Availability: information and systems are there when they are needed. Redundancy, backups and capacity planning protect it; a denial-of-service attack or a ransomware outage breaks it.

The three often pull against each other: locking data down tightly can make it harder to reach, and keeping systems always available can mean more copies of data to protect. Security work is largely about finding the right balance for each system.

Example

A hospital's patient records need all three. A leak of diagnoses breaks confidentiality, a changed medication dose breaks integrity, and an outage during an emergency breaks availability. Ransomware is a vivid case because modern attacks hit two at once: encrypting the records stops availability, and stealing a copy first breaks confidentiality.

Why it matters for a SOC analyst

The triad gives you a quick way to describe the impact of an incident in terms that managers understand: was data exposed, altered or made unavailable? It is also the first framework most certification exams, including CompTIA Security+, expect you to know, and it is the language risk and compliance teams use when they decide how serious an incident is.