Confidentiality, integrity, availability

Think about your school exam results sitting in a folder in the school office.

Three different things could go wrong with that folder, and they are not the same kind of wrong.

Someone could read it who has no business reading it — a classmate flips through the drawer and now knows everyone's marks. Nothing was damaged. Nothing was stolen, exactly. But something private stopped being private. That is a loss of confidentiality.

Someone could change it — your 48 becomes an 84 because a pen and a quiet afternoon were all it took. The folder is still there, still private, but it now tells a lie. That is a loss of integrity.

Or the folder could simply be gone when you need it — locked in an office nobody can open, soaked by a burst pipe, or buried in a pile nobody can search. The marks were never seen by the wrong person and never altered. They are just useless to you today. That is a loss of availability.

Those three — confidentiality, integrity, availability — are what security is actually about. People shorten it to the CIA triad, which has nothing to do with the American agency and everything to do with the first letters.

Here is why the three are worth separating in your head. When you hear about a breach, you can ask a sharper question than "was it bad?" You can ask which one broke. A leaked customer list is confidentiality. A tampered bank transfer is integrity. A website knocked offline on payday is availability. Different failures, different fixes.

And here is the part that most beginner explanations skip: the three pull against each other.

The safest possible place for your exam results is a sealed concrete block at the bottom of the ocean. Confidentiality: perfect. Integrity: perfect. Availability: catastrophic. Push any one pillar hard enough and you damage another. Force a 40-character password that changes weekly and people write it on a sticky note — you reached for confidentiality and lost it to the thing you did in its name.

So security is not "turn everything up to maximum". It is choosing, deliberately, how much of each you need for this system. A hospital's patient records need all three badly. A public bus timetable needs almost no confidentiality — it is meant to be read by everyone — but availability and integrity matter a lot, because a wrong or missing timetable strands people.

That question, which of the three matters most here and what am I willing to trade, is the one real practitioners are always answering, whether or not they say it out loud.

Confidentiality

Only the people who should be able to read something can read it. Broken by leaks, eavesdropping, stolen passwords and over-generous permissions.

Integrity

The data is still exactly what it should be — nobody changed it, and nothing corrupted it in transit or storage. Broken by tampering, faulty transfers and dishonest insiders.

Availability

You can actually reach the thing when you need it. Broken by crashed servers, ransomware, flooded data centres, expired certificates and attacks designed purely to overwhelm a service.

CIA triad

The three goals above, taken as a set. A way of naming what a control protects and what an incident destroyed.

Control

Any measure put in place to protect one of the three — a password rule, a backup schedule, a locked door, an encrypted disk, a code review. Controls are the "how"; the triad is the "why".

Hash

A short fingerprint calculated from a file. Change one character of the file and the fingerprint changes completely, which is how you prove a file arrived unaltered. Integrity's workhorse — the bars in the illustration are standing in for one.

You defend each pillar with different tools. Nothing here needs a budget to start practising.

For confidentiality

• Encrypt disks and backups, so a stolen laptop is a lost laptop and not a lost database.
• Give each person only the access their job needs, and take it back when the job changes. Most leaks are not clever attacks; they are old accounts nobody closed.
• Use a password manager and turn on two-step verification everywhere it is offered. Reused passwords are how one small breach becomes your breach.

For integrity

• Check hashes on anything you download and intend to run or trust.
• Keep an audit log that records who changed what and when, and store it somewhere the people being logged cannot edit.
• Require a second pair of eyes on changes that move money or alter records.

For availability

• Keep backups you have actually restored from. An untested backup is a rumour.
• Patch and monitor, so you hear about a failing disk before your users do.
• Know in advance who does what during an outage. Deciding that mid-incident is how a one-hour problem becomes a one-day one.

Then do the honest part: for whatever you are protecting, write down which pillar matters most and what you have chosen to trade away. If you cannot name the trade-off, you have not made a decision — you have made an assumption.