Confidentiality, Integrity and Availability

Introduction

Every information system has something that needs to be protected.
It could be a student’s personal information, a company’s customer database,
a bank account, an organization’s website, a hospital record, or an online
learning platform.

Cyber security professionals need a clear way to determine what “secure”
actually means. One of the most important frameworks used for this purpose
is the CIA Triad.

The CIA Triad is made up of three fundamental security principles:

• Confidentiality
• Integrity
• Availability

These three principles provide a foundation for understanding information
security and cyber security.

What Is the CIA Triad?

The CIA Triad is a security model used to describe three
essential objectives of information protection.

A secure information system should aim to ensure that:

• Information is available only to authorized people.
• Information remains accurate and trustworthy.
• Authorized users can access information and systems when required.

These objectives are represented by:

1. Confidentiality

Confidentiality means protecting information from unauthorized
access, use, disclosure, or exposure.

The goal is to ensure that information is available only to people, systems,
or processes that have permission to access it.

For example, a student’s private examination result should not be visible to
another student unless the student has been authorized to access it.

Examples of Confidential Information

Examples of information that may require confidentiality include:

• Passwords
• Bank account information
• Student records
• Medical records
• Employee information
• Customer databases
• Business plans
• Source code
• API keys
• Authentication tokens

Threats to Confidentiality

Confidentiality can be compromised in several ways.

Unauthorized Access

An attacker or unauthorized user gains access to information without permission.

Phishing

A user may be tricked into providing a password or other sensitive information
to an attacker.

Data Theft

Sensitive information may be copied or stolen from a device, server, database,
or cloud account.

Accidental Disclosure

An employee may accidentally send confidential information to the wrong person.

Shoulder Surfing

An attacker may observe someone entering a password or viewing sensitive
information.

Controls That Protect Confidentiality

Organizations can use several security controls to protect confidentiality.

• Strong passwords
• Multi-factor authentication
• Encryption
• Role-based access control
• Least-privilege access
• Secure authentication
• Data classification
• Physical security

Encryption

Encryption converts readable information into a protected form that cannot
easily be understood without the appropriate key or mechanism.

For example, sensitive information transmitted between a browser and a secure
website can be protected using encryption through HTTPS.

2. Integrity

Integrity means ensuring that information remains accurate,
complete, consistent, and trustworthy.

Integrity protects information against unauthorized or accidental modification.

For example, if a student’s examination score is changed from 85 to 25 without
authorization, the integrity of the student’s record has been compromised.

Examples of Information Integrity

Consider a banking system.

If a customer’s account balance is ₦500,000, an unauthorized modification that
changes the balance to ₦50,000 would represent an integrity problem.

Similarly, in an LMS, changing a student’s grade without proper authorization
would compromise the integrity of the academic record.

Threats to Integrity

Unauthorized Modification

An attacker changes information without permission.

Malware

Some malicious software can modify files, databases, configurations, or system
settings.

Human Error

Users can accidentally change or delete important information.

Database Attacks

An attacker may exploit an application vulnerability to modify records in a
database.

Insider Threats

A person with legitimate access may intentionally or accidentally modify
information improperly.

Controls That Protect Integrity

Integrity can be protected using controls such as:

• Access controls
• File permissions
• Database permissions
• Audit logs
• Checksums
• Digital signatures
• Version control
• Change management
• Backups

Audit Logs

Audit logs record activities performed on a system.

For example, an LMS could record:

• Who changed a student’s result.
• When the change occurred.
• What value existed before the change.
• What value replaced it.

Such records can help organizations investigate suspicious changes.

3. Availability

Availability means ensuring that authorized users can access
information, applications, devices, and systems when they need them.

An information system may contain accurate and confidential information but
still fail its security objectives if authorized users cannot access it when
needed.

Examples of Availability

Consider an online learning platform.

Students may need to log in to access lessons, submit assignments, or take
online examinations.

If the server becomes unavailable during an examination, students may not be
able to access the required services.

This is an availability problem.

Threats to Availability

Denial-of-Service Attacks

Attackers may attempt to overwhelm a service so that legitimate users cannot
access it.

Hardware Failure

Servers, storage devices, power supplies, or networking equipment can fail.

Software Failure

A software bug or configuration error can make an application unavailable.

Power Failure

A loss of electricity can interrupt systems and network services.

Natural Disasters

Flooding, fire, storms, or other disasters can damage infrastructure.

Ransomware

Some ransomware attacks can prevent users from accessing files or systems.

Controls That Protect Availability

Organizations can improve availability using:

• Regular backups
• Redundant servers
• Load balancing
• Power backup systems
• Disaster recovery plans
• Business continuity plans
• System monitoring
• Preventive maintenance
• Reliable network infrastructure

Confidentiality vs Integrity vs Availability

It is important to understand the difference between the three principles.

The CIA Triad in a Website

Consider a modern website that contains a registration system and database.

Confidentiality

Only authorized administrators should be able to view private user records.

Integrity

Users should not be able to manipulate database records they are not authorized
to modify.

Availability

The website should remain accessible to legitimate users.

The CIA Triad in a Database

Databases are excellent examples for understanding the three principles.

• Confidentiality:
  Only authorized users should access sensitive database records.
• Integrity:
  Database records should remain accurate and protected from unauthorized changes.
• Availability:
  Authorized applications and users should be able to access the database when required.

The CIA Triad in an LMS

A Dwallnet Learning Management System provides another practical example.

Student Records

Student names, contact information, login details, and other private records
require confidentiality.

Academic Results

Examination results and grades require strong integrity controls.

Learning Platform

The LMS needs availability so students can access lessons and instructors can
manage courses.

Therefore, one system can require all three security principles at the same time.

What Happens When Confidentiality Fails?

A confidentiality failure occurs when information is exposed to someone who
should not have access to it.

Examples include:

• A stolen password.
• A leaked customer database.
• An employee sending confidential documents to the wrong recipient.
• A private account being accessed without authorization.

The main concern is unauthorized disclosure or access.

What Happens When Integrity Fails?

An integrity failure occurs when information is changed, corrupted, deleted,
or manipulated in an unauthorized or inappropriate way.

Examples include:

• Changing examination results.
• Modifying bank transactions.
• Changing website content without authorization.
• Altering database records.

What Happens When Availability Fails?

An availability failure occurs when authorized users cannot access information
or services when they need them.

Examples include:

• A website being offline.
• A server crashing.
• A database becoming unavailable.
• A network outage.
• A ransomware incident preventing access to files.

Security Controls and the CIA Triad

Different controls can support different parts of the CIA Triad.

A single security control can sometimes contribute to more than one security
principle.

Balancing the CIA Triad

Security decisions may require organizations to balance confidentiality,
integrity, and availability.

For example, extremely strict access restrictions may improve confidentiality,
but if legitimate users cannot access information when required, availability
may be affected.

Similarly, security controls that require additional verification may improve
protection but can introduce additional steps for users.

Security professionals therefore consider the organization’s risks,
requirements, users, and operational needs when selecting controls.

Real-World Scenario

Imagine a hospital database containing patient records.

The hospital needs:

• Confidentiality:
  Only authorized healthcare personnel should access patient records.
• Integrity:
  Patient records should remain accurate and should not be changed without authorization.
• Availability:
  Authorized medical personnel should be able to access the records when needed.

A security failure affecting any of these principles could interfere with the
organization’s operations and objectives.

Practical Exercise

Create a CIA Triad analysis for a fictional Dwallnet student management system.

Identify:

1. Three examples of confidential information.
2. Three examples of information that must remain accurate.
3. Three services that must remain available.
4. One threat against each CIA principle.
5. One security control for each threat.

Example:

Class Discussion

Discuss the following questions:

1. What does confidentiality mean?
2. What is an example of an integrity failure?
3. Why is availability important?
4. Can one security incident affect all three CIA principles?
5. How can encryption support confidentiality?
6. How can backups support availability?
7. How can audit logs support integrity?
8. Why should developers understand the CIA Triad?
9. How does the CIA Triad apply to an LMS?

Code Example

The following PHP example demonstrates the three CIA principles in a simple
security model:

<?php

$security_principles = array(
    'confidentiality' => 'Only authorized users can access the information.',
    'integrity'       => 'Information must remain accurate and trustworthy.',
    'availability'    => 'Authorized users must be able to access the system when needed.'
);

foreach ( $security_principles as $principle => $description ) {
    echo '<strong>' . ucfirst( $principle ) . ':</strong> ';
    echo $description;
    echo '<br><br>';
}

?>

Key Takeaways

• The CIA Triad is a fundamental cyber security concept.
• Confidentiality protects information from unauthorized access or disclosure.
• Integrity protects information from unauthorized or improper modification.
• Availability ensures authorized users can access systems and information when required.
• Passwords and access control can support confidentiality.
• Audit logs and permissions can support integrity.
• Backups, redundancy, and monitoring can support availability.
• Websites, databases, networks, applications, and LMS platforms can all be analyzed using the CIA Triad.
• Effective security requires attention to all three principles.

Lesson Summary

Confidentiality, integrity, and availability form one of the most important
foundations of cyber security.

Confidentiality ensures that information is protected from
unauthorized access and disclosure.

Integrity ensures that information remains accurate,
complete, and trustworthy.

Availability ensures that authorized users can access
information and services when they need them.

Together, these principles help security professionals identify security
requirements, understand risks, select appropriate controls, and design more
secure systems.

As you continue this course, you will use the CIA Triad to understand common
security threats, vulnerabilities, attacks, defensive technologies, and
ethical security practices.