CIA Triad

CIA Triad#

The CIA triad is a foundational information security model designed to guide policies for protecting data and systems.
CIA stands for Confidentiality, Integrity, and Availability.

• Confidentiality: Ensures sensitive data is accessed only by authorized individuals. It restricts unauthorized viewing or exposure of private information.
  • Controls: Encryption, access control lists (ACLs), multi-factor authentication (MFA).
• Integrity: Guarantees that information and systems remain trustworthy, accurate, and have not been improperly altered or destroyed.
  • Controls: Hashing, version control, digital signatures.
• Availability: Ensures authorized users have timely, reliable access to information and systems exactly when they need them.
  • Controls: Data backups, redundancy, DDoS protection.

Going one more step beyond the CIA security triad, we can think of:

• Authenticity: Authentic means not fraudulent or counterfeit. Authenticity is about ensuring that the document/file/data is from the claimed source.
• Nonrepudiation: Repudiate means refusing to recognize the validity of something. Nonrepudiation ensures that the original source cannot deny that they are the source of a particular document/file/data.

DAD Triad#

The security of a system is attacked through one of several means. It can be via the disclosure of secret data, alteration of data, or destruction of data.

• Disclosure is the opposite of confidentiality. In other words, disclosure of confidential data would be an attack on confidentiality.
• Alteration is the opposite of Integrity. For example, the integrity of a cheque is indispensable.
• Destruction/Denial is the opposite of Availability.

The opposite of the CIA Triad would be the DAD Triad: Disclosure, Alteration, and Destruction.