The CIA Triad

Every security decision you make is a tradeoff between three properties: confidentiality, integrity, and availability. These three form the CIA Triad, and they show up in every design review, every incident postmortem, and every compliance framework. If you can identify which property is at risk, you can reason about the right mitigation instead of guessing.

Confidentiality — Only Authorized Parties Read It

Confidentiality means data is accessible only to the people and systems that are supposed to see it. When someone talks about a "data breach," they almost always mean a confidentiality failure.

The tools here are familiar: encryption at rest and in transit, access control lists, network segmentation, and classification labels that tell you which data is sensitive in the first place. A public S3 bucket full of customer records is the textbook confidentiality failure — the data was never encrypted, the bucket policy defaulted to public, and nobody audited it.

The tricky part is that confidentiality controls have costs. Encrypting everything at rest with customer-managed keys adds latency and operational complexity. Tight access controls slow down developers who need production data to debug issues. These are real tradeoffs, not excuses to skip encryption.

Integrity — Data Hasn't Been Altered

Integrity means that data is accurate and hasn't been tampered with, either in transit or at rest. When you download a binary and compare its SHA-256 checksum against the one published on the project's website, you're verifying integrity.

The toolbox includes cryptographic hashing, digital signatures, checksums, version control, and append-only audit logs. Database constraints and input validation are integrity controls too — they prevent bad data from entering the system in the first place.

A corrupted backup is an integrity failure you won't discover until the worst possible moment: when you need to restore from it. This is why backup verification (actually restoring to a test environment on a schedule) matters as much as the backup itself.

Availability — It's There When You Need It

Availability means the system is operational and accessible when authorized users need it. A DDoS attack is the classic availability threat, but so is a misconfigured deploy that takes down your API, or a single point of failure in your database tier.

The defenses are redundancy (multiple replicas, multi-region deployments), DDoS mitigation (rate limiting, CDN-level filtering), backups with tested restore procedures, and capacity planning. Auto-scaling is an availability control. So is a good on-call rotation.

The Tension Between the Three

Here's the part that makes security engineering interesting: optimizing for one property often hurts another.

Encrypting every field in your database improves confidentiality but makes querying harder, which can hurt availability if queries time out. Aggressive DDoS filtering protects availability but can block legitimate users — a confidentiality-adjacent problem if you're denying access to authorized parties. Immutable, append-only audit logs are great for integrity but terrible for flexibility — you can't delete a log entry even if it contains PII that a user has the right to have removed.

These tensions are why security isn't a checklist you finish. It's a set of tradeoffs you continuously rebalance based on your threat model.

Ransomware Attacks All Three

Ransomware is a good case study because it hits every leg of the triad simultaneously. It encrypts your data so you can't read it (confidentiality — the attacker now controls access). It modifies your files in place (integrity). And it takes your systems offline (availability). This is why ransomware is so devastating — you can't just fix one thing to recover.

Beyond the Triad: Authenticity and Non-Repudiation

Two properties often cited as extensions of the CIA Triad:

Authenticity means you can verify the identity of a sender or the origin of data. A digitally signed email proves (to a reasonable degree) that the claimed sender actually sent it. Authenticity overlaps with integrity but focuses on who, not just what.

Non-repudiation means a party can't deny having performed an action. If a user digitally signs a transaction, they can't later claim they didn't authorize it. Audit logs with cryptographic proof provide non-repudiation for system events.

Using the Triad: A Design Review Checklist

When you're reviewing any system design, run through these questions:

• Confidentiality: Who can read this data? Is it encrypted at rest and in transit? Are access controls enforced at the right layer? What happens if credentials leak?
• Integrity: How do we know data hasn't been tampered with? Are there checksums or signatures? Is input validated? Are audit logs tamper-proof?
• Availability: What are the single points of failure? What's the recovery time objective? Are backups tested? What happens under 10x load?

This isn't a compliance exercise. It's a thinking tool. The goal is to surface the tradeoffs you're making — intentionally or accidentally.

Real-World Failures, One Per Property

Confidentiality: In 2017, a public S3 bucket exposed 198 million U.S. voter records. No encryption, no access control, no monitoring. Pure configuration error.

Integrity: Corrupted database backups have taken down companies that thought they had disaster recovery plans. If you haven't restored from your backups recently, you don't have backups — you have hope.

Availability: The 2016 Dyn DNS DDoS attack took down Twitter, GitHub, Netflix, and dozens of other major sites by overwhelming a single DNS provider. Redundancy at every layer matters.

Key Takeaways

• The CIA Triad — confidentiality, integrity, availability — is the lens through which every security decision should be evaluated.
• Optimizing for one property often comes at the expense of another; security is about managing tradeoffs, not achieving perfection.
• Ransomware is uniquely destructive because it attacks all three properties simultaneously.
• Authenticity and non-repudiation extend the model to cover identity verification and accountability.
• Use the triad as a checklist during design reviews: ask who can read it, how you know it hasn't changed, and what happens when things go down.

Next up: Authentication vs Authorization — the difference between proving who you are and determining what you're allowed to do.