Module 1: Security Foundations

The CIA Triad: Confidentiality, Integrity, Availability

Every security decision you will ever make comes back to one question: what are you protecting, and from what kind of harm? The CIA triad gives you a simple, shared language for answering it. Security teams, auditors, regulators and vendors all use these three words, so learning them properly is the first step to thinking like a security professional rather than just following a checklist.

The three properties

Confidentiality means information is only seen by the people and systems that are allowed to see it. A leaked customer list, a payslip emailed to the wrong person, or a laptop stolen with an unencrypted hard drive are all confidentiality failures. Typical controls are access permissions, encryption, and careful handling of printouts and screens.

Integrity means information is accurate and has not been changed without authorisation. If an attacker changes the bank account number on a supplier invoice, or a disgruntled employee edits stock records, the data still exists and may still be private, but it can no longer be trusted. Controls include access rights, change logs, checksums and digital signatures, and approval steps such as requiring a second person to confirm payment details.

Availability means information and systems are there when legitimate users need them. Ransomware that locks files, a server room without power, a flooded office or a website overwhelmed by a denial-of-service attack are availability failures. Controls include backups, redundant equipment, power protection, capacity planning and tested recovery procedures.

Why the three pull against each other

The properties often compete. Locking a file away so tightly that only one person can open it improves confidentiality but harms availability if that person is on leave. Making a database copy on every staff laptop improves availability but multiplies the places it can leak. Good security is about finding the right balance for each kind of information, not maximising one property at any cost.

A useful habit is to rate each important information asset as low, medium or high for each property. A public price list needs high integrity (wrong prices cost money) and high availability, but low confidentiality. Payroll data needs high confidentiality and integrity, while availability can tolerate a short outage outside pay week.

Worked example: a small Nairobi pharmacy

Imagine a pharmacy on Ngong Road with two branches. It keeps a stock system, a patient prescription register, and an M-Pesa till for payments. Applying the triad:

From this table the owner can see where to spend effort first: strict access and encryption for the prescription register, daily backups and an offline fallback for the stock system, and a rule that only the owner can change payment or supplier details.

You can check integrity yourself with a cryptographic hash. If a file changes even by one character, its hash changes completely:

$ sha256sum price-list.csv
4b1c...e7a2  price-list.csv
# edit one price, then run again
$ sha256sum price-list.csv
9f03...11cd  price-list.csv

On Windows, the equivalent PowerShell command is Get-FileHash price-list.csv -Algorithm SHA256. Publishing the hash of a file lets others confirm they received exactly what you sent.

Related ideas you will meet

Some frameworks extend the triad. Authenticity asks whether data really comes from who it claims to come from, and non-repudiation asks whether someone can later deny an action they took, which is why signed records and audit logs matter. You may also hear the reverse acronym DAD: disclosure, alteration and destruction, which are the attacks against confidentiality, integrity and availability respectively.

Common mistakes to avoid

• Treating security as only confidentiality. Many expensive incidents are integrity failures, such as altered invoices, or availability failures, such as ransomware.
• Rating everything as high. If everything is critical, nothing is prioritised and budgets get spread too thin.
• Forgetting paper, phones and people. The triad applies to a notebook of passwords and a WhatsApp group just as much as to a server.
• Choosing controls before understanding the asset. Decide what matters about the information first, then select controls that protect that property.

Keep the triad in mind as you work through this course. Every threat in later modules damages at least one of these three properties, and every defence protects at least one.