1.1 The Basic Security Goals

The CIA Triad

Confidentiality, Integrity, and Availability (CIA) are the three core security goals. Confidentiality means only authorized people can view data. Integrity means data stays accurate and unaltered by unauthorized parties. Availability means systems and data are accessible to authorized users when needed. Every security control aims to protect one or more of these goals.

Confidentiality vs. Integrity vs. Availability

A breach of confidentiality occurs when private data (like passwords or medical records) is exposed to unauthorized viewers. A breach of integrity occurs when data is changed without permission, like a hacker altering grades. A breach of availability occurs when authorized users can't access a system, such as during a denial-of-service (DoS) attack.

Balancing the Goals

Security goals often trade off against each other. Strong confidentiality (many locks/passwords) can reduce availability (harder for legitimate users to get in quickly). Organizations must balance CIA based on their needs — a hospital may prioritize availability of patient data, while a bank may prioritize confidentiality of account numbers.

Key terms

CIA Triad

The three basic security goals: Confidentiality, Integrity, and Availability.

Confidentiality

Ensuring only authorized individuals can access or view data.

Integrity

Ensuring data remains accurate and unaltered by unauthorized parties.

Availability

Ensuring authorized users can access systems and data when needed.

Denial-of-Service (DoS) attack

An attack that overwhelms a system, preventing legitimate users from accessing it — an attack on availability.

Try an AP-style question

Which security goal is violated?

1. Confidentiality
2. Availability
3. Authentication
4. Integrity