Almost every security decision is about protecting one of three things: keeping data secret, keeping it correct, or keeping it usable. Together these are the CIA triad. It's the oldest model in information security and still the most useful first question in a threat model: if this goes wrong, what exactly is damaged?
The name has nothing to do with the intelligence agency. Some textbooks write it as AIC to avoid the confusion.
Confidentiality
Confidentiality means information is only readable by the people, processes and systems that are allowed to read it. A confidentiality failure is a leak: a public storage bucket, an API that returns another customer's records, an employee emailing a spreadsheet to their personal account, or a password database copied by an attacker.
Typical controls are encryption (in transit and at rest), authentication and authorisation, data minimisation (not collecting what you don't need) and classification, which tells people how carefully a piece of data must be handled.
Integrity
Integrity means information is accurate and complete, and only changed by authorised people in authorised ways. An integrity failure is a change nobody should have been able to make: a bank transfer amount altered in transit, a price changed in a shopping basket, a log entry deleted to hide an intrusion, or a build server tampered with so that it ships malicious code.
Integrity failures are the quietest of the three. A leak usually gets noticed; a subtly wrong number in a database can sit there for months while decisions are made on it. Controls include input validation, access control on writes, digital signatures and checksums, database constraints, audit logs and change review.
Availability
Availability means systems and data can be used when they are needed. An availability failure is anything that stops legitimate use: a denial-of-service attack, ransomware encrypting a file server, an expired TLS certificate, a cloud region outage, or a single slow query that exhausts a connection pool.
Availability is where security overlaps most with reliability engineering. Controls include redundancy, rate limiting, capacity planning, tested backups and restore procedures, and monitoring that alerts before users do.
The triad in practice: trade-offs
The three properties often pull against each other, and that's the triad's real value: it makes the trade-off explicit.
| Decision | Helps | Can hurt |
|---|---|---|
| Encrypt every backup with a key held by one person | Confidentiality | Availability, if that person or key is lost |
| Lock accounts after five failed logins | Confidentiality | Availability: an attacker can lock out every user on purpose |
| Replicate the database to three regions | Availability | Confidentiality: three copies to protect, in three jurisdictions |
| Require two approvals for every production change | Integrity | Availability: slower incident fixes |
None of these is right or wrong in general. The right choice depends on which property matters most for the asset involved, which is why identifying assets comes before choosing controls.
Worked example: Invoicely
Invoicely is the fictional SaaS invoicing app used throughout this knowledge base (the full model is in the threat model example). Applying the triad to its main assets gives a clear priority for each:
- Customer invoices: confidentiality first. One customer reading another's invoices would end the business. That's why threat T2 (changing the invoice ID in the API) was scored critical.
- Payment status: integrity first. If an attacker can forge a "paid" webhook (T4), customers stop trusting the product even if no data leaks.
- Invoice sending at month end: availability first. Most invoices go out in the last three days of the month, so a flooded render queue (T9) hurts far more on the 30th than on the 10th.
How the CIA triad relates to STRIDE
The triad describes what can be damaged. STRIDE describes how, and three of its six categories map directly onto it:
- Information disclosure is an attack on confidentiality.
- Tampering is an attack on integrity.
- Denial of service is an attack on availability.
The other three (spoofing, repudiation and elevation of privilege) cover identity and accountability, which the triad only addresses indirectly. That gap is why some models add properties. The best known is the Parkerian hexad, which adds possession, authenticity and utility. Many frameworks also list non-repudiation (someone can't plausibly deny an action they took) and authenticity as separate goals.
Common mistakes
- Treating security as confidentiality only. Teams that only ask "can it leak?" miss tampering and outages, which are often the more likely incidents.
- Rating every asset "high, high, high". If everything is maximally important, the triad stops helping you choose. Force a ranking per asset.
- Forgetting availability is a security property. A denial-of-service threat belongs in the threat model, not just in the operations team's runbook.
Key takeaways
- Confidentiality, integrity and availability are the three ways a security incident can hurt you: data is exposed, data is wrong, or the system can't be used.
- Each asset needs a different balance. For a public website integrity and availability matter most; for medical records, confidentiality dominates.
- Integrity failures are the quietest of the three and often the most expensive, because nobody notices until decisions have been made on bad data.
- STRIDE extends the triad: information disclosure, tampering and denial of service map onto C, I and A, and spoofing, repudiation and elevation of privilege cover the identity questions the triad leaves out.
Frequently asked questions
What are the three parts of the CIA triad?
Confidentiality (data is only readable by people allowed to read it), integrity (data is accurate and only changed by people allowed to change it) and availability (systems and data work when they are needed).
Which part of the CIA triad is most important?
None is most important in general. It depends on the asset. A payment ledger cares most about integrity, a health record about confidentiality, and an emergency dispatch system about availability. Threat modeling starts by deciding which matters most for each asset.
Is ransomware an attack on confidentiality, integrity or availability?
Usually all three. Encrypting files attacks availability, and modern ransomware groups also steal data before encrypting it (confidentiality) and sometimes alter backups (integrity).
What is the Parkerian hexad?
An extension of the CIA triad proposed by Donn Parker in 1998. It adds possession (control of the data), authenticity (the data comes from who it claims) and utility (the data is still usable, for example not encrypted with a lost key).