The CIA Triad

Almost every security control exists to protect one of three things, together called the CIA triad.

Example: the same system, three different failure modes

• Confidentiality, only authorized people can see the data. Fails when: an attacker reads private messages they shouldn't be able to.
• Integrity, the data hasn't been tampered with. Fails when: someone silently edits a payment amount in transit.
• Availability, authorized people can actually access the system when they need it. Fails when: a flood of fake traffic takes a site offline for real users.

A useful habit: when evaluating any security decision, ask which of the three it's protecting, and whether it might be quietly trading off one for another. Encrypting every field in a database, for instance, strongly protects confidentiality but can hurt availability if it makes the system too slow to use under real load.