The CIA Triad: Confidentiality, Integrity, Availability

If you are starting out in cybersecurity, whether you are a BTS SIO student or an IT manager at an SME, there is one model you will encounter everywhere: the CIA Triad. Three letters standing for Confidentiality, Integrity, Availability: confidentiality, integrity, and availability. This is no theoretical gimmick: it is the framework used by CISOs, auditors, and international standards (ISO 27001, NIST) to assess the security of any information system. In this guide, we break down each pillar with concrete examples, then explore why the real challenge is not maximising all three, but balancing them.

What exactly is the CIA Triad?

Devised in the 1970s, this model asks a simple question: what does "securing information" really mean? The answer lies in three complementary guarantees:

• Confidentiality: only authorised individuals can read the information.
• Integrity: the information has not been modified, tampered with, or corrupted.
• Availability: information and services are accessible when needed.

A system is only considered secure if all three properties hold at the same time. A perfectly encrypted database that is inaccessible for three days? A failure of availability. A blazing-fast website where prices can be modified by anyone? A failure of integrity. The Triad serves precisely to spot the pillar that was overlooked.

Another advantage: it provides a common vocabulary. When a technician, an auditor, and an executive discuss a risk, the Triad enables them to classify the impact ("this flaw affects customer data confidentiality") and prioritise measures. Recent European regulations like NIS2 or DORA implicitly rely on this breakdown: covered organisations must prove they control their risks across all three areas.

Pillar 1: Confidentiality - who is allowed to read?

Confidentiality guarantees that information is accessible only to explicitly authorised individuals, machines, or processes. The objective: prevent any unwanted disclosure, whether from an external attacker, a malicious employee (insider threat), or simple human error, like an email sent to the wrong recipient or a cloud folder inadvertently shared publicly.

Typical threats to this pillar:

• Phishing and social engineering, now boosted by generative AI, aimed at stealing credentials.
• Infostealers, malware that harvests passwords and session cookies for resale.
• Data leaks caused by misconfigured servers or cloud buckets.
• Espionage, industrial or state-sponsored, targeting intellectual property.

On the defence side, standard measures include:

• Data encryption, both at rest and in transit (TLS, encrypted disks).
• Strong authentication: MFA, ideally with hardware security keys (FIDO2).
• Access control based on the principle of least privilege: everyone accesses only what they need to work.
• Awareness training for teams, because humans remain the primary attack vector.

Pillar 2: Integrity - is the data authentic?

Integrity ensures that data and systems have not been altered illegitimately or invisibly. It is the most discreet pillar, but often the most dangerous when compromised: stolen data gets noticed, whereas falsified data can go unnoticed for months and corrupt every decision based upon it.

In practical terms, an integrity compromise can take the form of a Man-in-the-Middle attack modifying traffic on the fly, destructive wiper malware silently corrupting files, wire fraud backed by a voice deepfake impersonating the CFO... or simply human error: an employee overwriting the wrong row in the ERP pricing database.

To protect this pillar, we rely on verification mechanisms:

• Cryptographic hashing (SHA-256, SHA-3): a unique fingerprint that changes at the slightest modified bit, perfect for verifying that a backup or downloaded file is intact.
• The digital signature, which proves both the origin and the non-tampering of a document or software update.
• Audit logs and immutable storage (WORM), which make any modification traceable.
• Strict management of write permissions, to limit who can modify what.

Pillar 3: Availability - does it work when you need it?

Availability guarantees that services and data are accessible, at the right moment, to legitimate users. In an all-digital economy, fault tolerance is close to zero: an e-commerce site offline during sales means immediately lost turnover, downgraded search rankings, and customers who do not return.

The main threats:

• DDoS (distributed denial of service) attacks, which overwhelm a service with requests.
• Ransomware, which encrypts servers and workstations to paralyse operations.
• Outages: hardware, electrical, or cloud provider.
• Physical disasters: fire, flooding, hardware theft.

Defences rely on redundancy (no single point of failure, the famous SPOF), regularly tested business continuity and disaster recovery plans (BCP/DRP), load balancing, and above all, robust backups.

The three pillars at a glance

Case study: an SME facing ransomware

Take an SME with 25 employees in building materials. One Monday morning, a sales rep clicks on a malicious attachment. Within a few hours, ransomware encrypts the file server and the ERP. Let's analyse the incident through the Triad:

1. Availability: the most visible impact. No quotes, no invoicing, no stock management. Operations are at a standstill.
2. Confidentiality: the attackers use "double extortion". Before encrypting, they exfiltrated customer records and HR data, and are threatening to publish them if the ransom is not paid.
3. Integrity: when restoring, the business owner must ask the right question: are the backups clean, or were they corrupted before the attack? Without hash verification, there is no way to be sure.

A single incident, three pillars affected. This is exactly why the Triad is useful: it forces an evaluation of the full impact of an attack, not just its loudest symptom. The SME that categorised ransomware as "an availability issue" discovers that it also has a personal data breach to report to the CNIL within 72 hours (a GDPR requirement).

The real challenge: balancing the three pillars

Here is the key point many beginners miss: you cannot maximise all three pillars at once. Strengthening one often comes at the expense of the others, because budget, processing power, and user patience are limited. A few classic trade-offs:

• Confidentiality vs availability: strict hardware-key MFA protects accounts well... until an employee travelling loses their key and finds themselves locked out during an emergency.
• Confidentiality vs performance: encrypting every field in a large database slows down business application response times, degrading perceived availability.
• Integrity vs confidentiality: logging every action in detail improves traceability, but overly verbose logs can capture plaintext passwords or personal data, creating a new vulnerability.

The right balance depends on the business. A hospital will prioritise availability (an inaccessible patient record could cost a life) and confidentiality (health data). A bank will place transaction integrity at the top. An SME showcase website will focus primarily on availability. There is no universal setting: it comes down to risk analysis.

Absolute security does not exist. Cybersecurity is the science of informed compromise: identifying what is critical to your organisation, and protecting the three pillars in proportion.

How to use the Triad day to day

Whether you are preparing for a BTS SIO exam or auditing a small business IT system, the approach is the same:

1. Inventory assets: customer data, ERP, email, website, backups...
2. Assess each asset across the three axes: what would be the impact of a leak (C), tampering (I), or unavailability (A)?
3. Prioritise: start with the assets where the impact is highest and protection is weakest.
4. Treat with measures tailored to each pillar, then regularly verify (restoration tests, permissions reviews, crisis exercises).

You now have the foundations. The CIA Triad is only the first of many models: to go further (threats, risk analysis, defence in depth, hands-on workshops), take a look at the sessions in our BTS SIO 1 library, moving from theory to practice.