The CIA triad: confidentiality, integrity and availability

Security can feel like an endless list of threats, products and acronyms. Underneath almost all of it sit three simple questions about any piece of information or any system: can only the right people see it, can you trust that it has not been changed, and can you reach it when you need it? Security professionals call these confidentiality, integrity and availability, and the trio is known as the CIA triad. It has nothing to do with the intelligence agency; it is simply the shortest useful definition of what “secure” means.

Confidentiality: only the right people can see it

NIST defines confidentiality as preserving authorised restrictions on access and disclosure, including the means for protecting personal privacy and proprietary information. In plain terms: your medical file should be readable by you and your doctor, not by your employer or a stranger on the same café Wi-Fi.

• What breaks it: stolen passwords, a lost unencrypted laptop, a misconfigured cloud folder shared with “anyone with the link”, an app that quietly uploads your contacts.
• What protects it: encryption (FileVault on a Mac, HTTPS on the web, end-to-end encryption in messaging), strong authentication, and giving each app and person only the access they need.

Integrity: you can trust it has not been changed

Integrity means guarding against improper modification or destruction of information, and making sure information is authentic. A bank transfer that arrives with a different account number, a software update altered to carry a hidden extra, or a contract whose amount was edited after signing are all integrity failures, even if nobody “saw” anything secret.

• What breaks it: tampering in transit, a compromised download site, malicious software that edits files, or simple human error with no record of who changed what.
• What protects it: cryptographic hashes and digital signatures (on a Mac, Gatekeeper checks the signature of apps downloaded from the internet before you first open them), version history, backups you can compare against, and logging who changed what and when.

Availability: you can reach it when you need it

Availability means timely and reliable access to information and systems. A hospital system that is perfectly confidential but offline during an emergency has failed. Ransomware is, above all, an attack on availability: it makes your own files unusable until you pay, and modern groups add a confidentiality attack on top by threatening to publish what they stole.

• What breaks it: ransomware, hardware failure, a flooded server room, a denial-of-service attack, a single account that locks everyone out when its owner leaves.
• What protects it: tested backups (at least one offline or offsite), redundancy, capacity planning, and incident response plans that people have actually rehearsed.

The three pull against each other

The triad is useful precisely because its three goals compete. Locking data away in an encrypted vault with one key held by one person maximises confidentiality but threatens availability: lose the key and the data is gone. Giving everyone access so work never stops helps availability and hurts confidentiality. Every security design is a balance, and the right balance depends on what the information is and who depends on it. A family photo album, a patient record and a company’s payment system each deserve a different mix.

Beyond the triad

Some frameworks add properties such as authenticity (you know who sent it), non-repudiation (the sender cannot plausibly deny sending it) and privacy (what is collected about people at all). They are best seen as refinements of the same three ideas. For everyday use, the triad is enough to turn a vague worry into a concrete question: which of the three would I lose, and what would it cost me?

Using the triad on your own Mac

Pick the three things on your computer you would least like to lose or leak, and ask the triad questions for each. Is it encrypted and behind a strong login (confidentiality)? Would you notice if it were changed, and do apps you run come from signed, trusted sources (integrity)? If the Mac died tonight, could you get it back tomorrow (availability)? A firewall such as FireAI mainly helps on the confidentiality side: it shows which app connects where and lets you stop an app from sending data you did not agree to. Integrity and availability need their own tools, above all signed software and backups.