Cybersecurity Foundations (Grades 6–8) · lesson 2 of 48 · 20 min
Why the CIA Triad Is the Foundation of Everything
Every cybersecurity decision — whether to use a password, encrypt a file, back up data, or block a network port — ultimately comes back to three questions: Is this information being kept private? Is it accurate? Can people access it when they need it? These three questions are the CIA Triad.
The CIA Triad is not a government agency. It is a framework — a mental model that security professionals use to evaluate threats, design defences, and investigate incidents. It was formalised in the 1970s and remains the most widely used framework in cybersecurity today.
By the end of this lesson you will be able to define all three principles with precision, identify which principle is violated in any given attack scenario, explain the trade-offs between them, and apply the triad to real-world incidents.
Why three principles?
Security researchers found that almost every attack, breach, or failure can be categorised by what it damages: the privacy of data, the accuracy of data, or the access to data. Having three clear categories makes it much easier to design defences and communicate about threats. A doctor who says “the patient has a fever” is more useful than one who says “something is wrong.” The CIA Triad gives security professionals a shared vocabulary.
The Three Principles — Deep Dive
Confidentiality — keeping secrets secret
Confidentiality means that information is only accessible to people who are authorised to see it. It is not just about passwords — it covers encryption, access controls, data classification, and physical security. If someone who should not see your data can see it, confidentiality has been violated.
- Protects against
- Data breaches
- Eavesdropping
- Unauthorised access
- Insider snooping
- Enforced by
- Encryption
- Access controls (login, permissions)
- Data classification
- Physical locks and screen locks
Integrity — keeping data accurate and trustworthy
Integrity means that information has not been altered without authorisation. It is not enough for data to be secret — it also needs to be correct. A medical record that has been tampered with, a financial transaction that has been modified, or a software update that has been replaced with malware are all integrity violations.
Integrity is enforced through hashing (creating a digital fingerprint of data so any change is detectable), digital signatures (proving who created a file and that it has not changed), and audit logs (recording every change to a system so tampering can be detected).
- Protects against
- Data tampering
- Man-in-the-middle attacks
- Malicious software updates
- Database manipulation
- Enforced by
- Cryptographic hashing (SHA-256)
- Digital signatures
- Version control
- Audit logs and change tracking
Availability — keeping systems accessible when needed
Availability means that authorised users can access systems and data when they need them. A perfectly secure system that nobody can use is not useful. Availability is threatened by hardware failures, software bugs, natural disasters, and attacks like DDoS (Distributed Denial of Service) and ransomware.
Availability is enforced through redundancy (having backup systems), backups (copies of data stored separately), disaster recovery plans, and DDoS mitigation services.
- Protects against
- DDoS attacks
- Ransomware lockouts
- Hardware failures
- Natural disasters
- Enforced by
- Redundant systems and failover
- Regular tested backups
- Disaster recovery plans
- DDoS mitigation services
Activity 1 — Match the Principle
Each description below relates to one of the three CIA principles. Match it to the correct principle.
CIA Triad Matching
The Trade-offs — When CIA Principles Conflict
Here is something that surprises most beginners: the three CIA principles can conflict with each other. Making a system more secure in one dimension can make it less secure — or less usable — in another. Security professionals constantly navigate these trade-offs.
Confidentiality vs. Availability
The more you restrict access to keep data confidential, the harder it becomes to access when needed. A hospital that encrypts patient records with a complex key management system is protecting confidentiality — but if a doctor cannot access a patient’s allergy information in an emergency because the key server is down, availability has failed. The right balance depends on the risk: how sensitive is the data, and how critical is immediate access?
Integrity vs. Availability
Integrity checks take time. Every time you download a software update, your computer can verify its hash to confirm it has not been tampered with. But if that check adds 30 seconds to every file access on a high-speed trading system, it may be unacceptable. Some systems skip integrity checks for performance — accepting a small integrity risk to maintain availability.
Confidentiality vs. Integrity
Sometimes you need to prove that data is authentic (integrity) without revealing what it contains (confidentiality). Digital signatures solve this elegantly — they prove a document came from a specific person and has not been changed, without revealing the document’s contents to the verifier. This is why digital signatures are used in email security, software distribution, and legal documents.
Designing a school grade database
Confidentiality requirement Only teachers and the student themselves can view grades. Other students, parents of other students, and the public cannot. Integrity requirement Grades can only be changed by the teacher who assigned them, through the official system. Any change is logged with a timestamp and the teacher’s identity. Availability requirement The system must be accessible during school hours and during report card periods. Planned maintenance happens on weekends. The trade-off During a DDoS attack on the school’s network, the grade system goes offline (availability fails). The school must decide: is it better to take the system offline to protect integrity and confidentiality, or keep it running in a degraded state?
Activity 2 — Which Principle Was Violated?
Read each scenario and decide which CIA principle was most directly violated. Some scenarios may touch more than one — choose the primary violation.
CIA Violation Identifier
Real-World Case Studies
The CIA Triad is not abstract theory — every major breach in history can be analysed through it. Here are three landmark cases.
Case 1: Equifax Data Breach (2017) — Confidentiality
Attackers exploited an unpatched vulnerability in Equifax’s web application and spent 76 days inside the network, exfiltrating the personal data of 147 million people — names, Social Security numbers, birth dates, addresses, and credit card numbers. The data was never changed or deleted — it was simply read and copied. This is a pure confidentiality failure. The root cause: a known vulnerability that had not been patched for two months. The lesson: confidentiality requires keeping software up to date, not just setting access controls.
Case 2: SolarWinds Supply Chain Attack (2020) — Integrity
Attackers compromised the build system of SolarWinds, a software company whose tools are used by 18,000 organisations including US government agencies. They inserted malicious code into a legitimate software update. When organisations installed the update, they unknowingly installed a backdoor. The data was not stolen at the point of compromise — the integrity of the software itself was violated. This attack affected the US Treasury, Department of Homeland Security, and dozens of Fortune 500 companies. The lesson: integrity must be verified at every step of the software supply chain.
Case 3: Colonial Pipeline Ransomware (2021) — Availability
A ransomware group called DarkSide attacked Colonial Pipeline, which supplies 45% of the fuel for the US East Coast. The company shut down its pipeline operations for six days out of caution, causing fuel shortages across multiple states. The attackers did not destroy data — they encrypted it and demanded a ransom. The primary impact was availability: the pipeline could not operate. Colonial Pipeline paid approximately $4.4 million in ransom. The lesson: availability failures in critical infrastructure have real-world physical consequences. Tested backups and incident response plans are not optional.
Knowledge Check — CIA Triad
CIA Triad Assessment
What does the “I” in the CIA Triad stand for?
- Intelligence
- Integrity
- Identity
- Infrastructure
Answer: Integrity
Integrity means data is accurate and has not been tampered with. It is enforced through hashing, digital signatures, and audit logs.
A hacker intercepts a student’s exam submission and changes their answers before it reaches the teacher. Which CIA principle is primarily violated?
- Confidentiality
- Integrity
- Availability
- Authentication
Answer: Integrity
The data was modified without authorisation — the submission no longer accurately reflects what the student wrote. This is an integrity violation.
A DDoS attack floods a school’s learning management system with traffic, making it inaccessible to students during exam week. Which CIA principle is violated?
- Confidentiality
- Integrity
- Availability
- None — DDoS does not violate CIA
Answer: Availability
The system is inaccessible to authorised users — this is an availability violation. DDoS attacks are one of the most common availability threats.
Which tool is the primary mechanism for enforcing Confidentiality?
- Audit logs
- Encryption
- Redundant backups
- Digital signatures
Answer: Encryption
Encryption scrambles data so only someone with the correct key can read it — making it the primary tool for confidentiality. Audit logs enforce integrity, backups enforce availability, and digital signatures enforce integrity.
A hospital stores patient records in a highly encrypted system, but the encryption key server goes down during an emergency. A doctor cannot access a patient’s allergy information. What does this illustrate?
- A confidentiality failure — the data was exposed
- An integrity failure — the data was altered
- A trade-off where confidentiality measures reduced availability
- This is not a CIA Triad issue
Answer: A trade-off where confidentiality measures reduced availability
This is a classic CIA trade-off. Strong confidentiality controls (encryption) reduced availability when the key server failed. Security design must balance all three principles.
True or False: The three CIA principles never conflict with each other — a system can always be maximally confidential, maximally available, and maximally integrity-protected at the same time.
- True
- False
Answer: False
False. The CIA principles frequently trade off against each other. Stronger confidentiality controls can reduce availability. Integrity checks can slow systems. Security professionals must find the right balance for each context.
Try it: CIA triad sort
Previous lesson: What is cybersecurity?
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: Common threats and attackers