What Is the CIA Triad?

What Is Information Security?

Information security refers to the efforts made to prevent critical incidents such as unauthorized access to, destruction of, or alteration of the information we hold. In short, it ensures that existing information is accessed and processed only with our permission.

Information identifies us or a company’s customers. That is why we do not want it to fall into the hands of malicious individuals. With the information obtained, they can:

• From a personal perspective: Unauthorized access to your account could lead to your loved ones being scammed.
• From a business perspective: An e-commerce site that suffers a data breach will incur financial losses and lose customers.

What Does the CIA Triad Consist Of?

The ISO/IEC 27001 Standard addresses information security under three main headings:

• C — Confidentiality
• I — Integrity
• A — Availability

When the first letters of these three components are combined, they form “CIA”.

Confidentiality

Only authorized recipients should be able to access the data.

When you sign up for an e-commerce site, your first name, last name, email address, password, and credit card information are stored in the database. Ensuring that this information is visible only to authorized individuals is the foundation of confidentiality. Only you should know your password, and your address information should be shared only with relevant parties during the shipping process.

Integrity

It ensures that data will not be altered during transmission.

When you transfer $100, the recipient should actually receive $100. If integrity cannot be ensured:

• $1,000 might be sent instead of $100
• The money might be withdrawn from your account but not deducted from your balance
• A $100 purchase might be recorded as $1,000 in the system

Availability

This refers to authorized users being able to access data in a timely and reliable manner.

Imagine an exam results system accessed by millions of people at the same time. If the infrastructure is inadequate, no one will be able to access their results due to excessive traffic. Or, if a ransomware infection encrypts all the data on the server and no backups have been taken—you’re out of luck.

Measures

For Confidentiality:

• Strong password policy
• Two-factor authentication (2FA)
• Encryption of sensitive data
• Security awareness training

For Integrity:

• Use of checksums
• Regular backups
• Secure software development processes (SSDLC)

For Availability:

• Backup and disaster recovery systems
• Scalable infrastructure design
• DDoS protection mechanisms

Conclusion

Is data absolutely secure when the CIA Triad is fully implemented? No. No system is absolutely secure — but efforts are always made to ensure it remains secure. This struggle will continue as long as data exists and there are those who seek to access it.