CIA Triad (Confidentiality, Integrity, Availability)

Master the three fundamental principles of information security that form the foundation of cybersecurity with real-world examples and practical applications.

60 min•By Priygop Team•Last updated: Feb 2026

Confidentiality: Keeping Secrets Safe

Confidentiality ensures that information is accessible only to authorized individuals, entities, or processes. It prevents unauthorized disclosure of sensitive information. Think of it as a locked diary - only you have the key, and no one else can read your private thoughts.

Confidentiality in Practice

Password protection: Only you know your password
encryption: Scrambling data so only authorized parties can read it
Access controls: Limiting who can see sensitive information
Data classification: Marking information as public, internal, or confidential
Secure communication: Using encrypted channels for sensitive data

Integrity: Ensuring Data Accuracy

Integrity ensures that information remains accurate, complete, and unmodified during storage, processing, or transmission. It prevents unauthorized alteration of data. Imagine a bank account - the balance must be accurate and only change through legitimate transactions.

Integrity Protection Methods

Digital signatures: Verify that data hasn't been tampered with
Checksums: Mathematical values that detect changes in data
Version control: Track changes to documents and files
Audit trails: Log all modifications to sensitive data
Backup systems: Maintain copies of original data

Availability: When You Need It

Availability ensures that information and resources are accessible to authorized users when needed. It prevents service disruptions and ensures business continuity. Like having a reliable car that starts every time you need to go somewhere.

Availability Strategies

Redundancy: Multiple systems to prevent single points of failure
Backup systems: Quick recovery from system failures
Load balancing: Distributing traffic across multiple servers
Disaster recovery: Plans for major system failures
Monitoring: Early detection of potential problems

CIA Triad Implementation Example

Example

# Example: CIA Triad in Practice - Online Banking System
const crypto = require('crypto');

// CONFIDENTIALITY - Data encryption
function encryptData(data, key) {
    const cipher = crypto.createCipher('aes-256-cbc', key);
    let encrypted = cipher.update(data, 'utf8', 'hex');
    encrypted += cipher.final('hex');
    return encrypted;
}

function decryptData(encryptedData, key) {
    const decipher = crypto.createDecipher('aes-256-cbc', key);
    let decrypted = decipher.update(encryptedData, 'hex', 'utf8');
    decrypted += decipher.final('utf8');
    return decrypted;
}

// INTEGRITY - Data Hashing and Digital Signatures
function createHash(data) {
    return crypto.createHash('sha256').update(data).digest('hex');
}

function verifyIntegrity(originalData, receivedHash) {
    const calculatedHash = createHash(originalData);
    return calculatedHash === receivedHash;
}

// AVAILABILITY - System Health Monitoring
function checkSystemHealth() {
    return {
        status: 'healthy',
        uptime: process.uptime(),
        memory: process.memoryUsage(),
        timestamp: new Date().toISOString(),
        responseTime: Math.random() * 100 + 50 // Simulated response time
    };
}

// Example: Banking Transaction with CIA Triad
const bankingTransaction = {
    accountNumber: "1234567890",
    amount: 1000,
    recipient: "John Doe",
    timestamp: new Date().toISOString()
};

// Step 1: CONFIDENTIALITY - Encrypt sensitive data
const encryptionKey = "bank-secret-key-2024";
const encryptedTransaction = encryptData(JSON.stringify(bankingTransaction), encryptionKey);
console.log("Confidentiality: Transaction encrypted");

// Step 2: INTEGRITY - Create hash to verify data hasn't changed
const transactionHash = createHash(JSON.stringify(bankingTransaction));
console.log("Integrity: Hash created for verification");

// Step 3: AVAILABILITY - Check system health before processing
const systemStatus = checkSystemHealth();
if (systemStatus.status === 'healthy') {
    console.log("Availability: System is healthy, processing transaction");
} else {
    console.log("Availability: System unavailable, transaction queued");
}

// Verify integrity when receiving data
const isDataIntact = verifyIntegrity(JSON.stringify(bankingTransaction), transactionHash);
console.log(`Data integrity verified: ${isDataIntact}`);

// Decrypt data when needed
const decryptedTransaction = decryptData(encryptedTransaction, encryptionKey);
console.log("Transaction decrypted for processing:", JSON.parse(decryptedTransaction));

CIA Triad Trade-offs

Confidentiality vs Availability: Strong encryption may slow down systems
Integrity vs Performance: Extensive logging may impact speed
Availability vs security: More security measures may reduce uptime
Balancing act: Finding the right mix for your organization
Risk assessment: Understanding what's most important for your use case

Interactive Exercise: CIA Triad Assessment

Example

# Mini-Project: CIA Triad Assessment
// Assess how well different systems implement the CIA Triad

const systemAssessments = {
    email: {
        confidentiality: "Medium - Emails can be intercepted",
        integrity: "Low - Emails can be modified in transit",
        availability: "High - Email services are generally reliable"
    },
    onlineBanking: {
        confidentiality: "High - Strong encryption and authentication",
        integrity: "High - Digital signatures and audit trails",
        availability: "High - Redundant systems and monitoring"
    },
    socialMedia: {
        confidentiality: "Low - Data is often shared publicly",
        integrity: "Medium - Some protection against tampering",
        availability: "High - Generally reliable access"
    },
    cloudStorage: {
        confidentiality: "High - encryption at rest and in transit",
        integrity: "High - Version control and checksums",
        availability: "High - Multiple data centers and redundancy"
    }
};

// Calculate CIA Triad score
function calculateCIAScore(system) {
    const scores = {
        confidentiality: system.confidentiality === 'High' ? 3 : system.confidentiality === 'Medium' ? 2 : 1,
        integrity: system.integrity === 'High' ? 3 : system.integrity === 'Medium' ? 2 : 1,
        availability: system.availability === 'High' ? 3 : system.availability === 'Medium' ? 2 : 1
    };
    
    const totalScore = scores.confidentiality + scores.integrity + scores.availability;
    const maxScore = 9;
    const percentage = (totalScore / maxScore) * 100;
    
    return {
        scores,
        totalScore,
        percentage,
        level: percentage >= 80 ? 'Excellent' : 
               percentage >= 60 ? 'Good' : 
               percentage >= 40 ? 'Fair' : 'Poor'
    };
}

// Assess each system
Object.keys(systemAssessments).forEach(systemName => {
    const assessment = calculateCIAScore(systemAssessments[systemName]);
    console.log(`${systemName.toUpperCase()} CIA Triad Score:`);
    console.log(`  Confidentiality: ${systemAssessments[systemName].confidentiality}`);
    console.log(`  Integrity: ${systemAssessments[systemName].integrity}`);
    console.log(`  Availability: ${systemAssessments[systemName].availability}`);
    console.log(`  Overall Score: ${assessment.percentage}% - ${assessment.level}`);
    console.log('---');
});