CIA Triad Flashcards

Confidentiality, Integrity, Availability — the three foundational principles of information security.

Same as CIA Triad (Availability, Integrity, Confidentiality). Alternative name used to avoid confusion with the Central Intelligence Agency.

Only authorized individuals can access data. Prevents unauthorized disclosure. Protected by encryption, access controls, and 2FA.

Data is stored and transferred exactly as intended. Any modification is detectable. Protected by hashing, digital signatures, certificates.

Systems and data are accessible to authorized users whenever needed. Protected by redundancy, fault tolerance, and patching.

Confidentiality. Encodes data so only parties with the correct key can read it. Protects data in transit and at rest from unauthorized viewing.

Confidentiality. Restricts which users can reach which resources. Role-based, permission-based, or attribute-based.

Confidentiality. Requires a second verification factor, reducing risk of unauthorized access even if credentials are stolen.

Integrity. Creates a fixed-length fingerprint of data. Any change to data = different hash. Does NOT prove who sent the data.

Integrity. Mathematical scheme using private/public keys to verify both data integrity AND sender identity. Provides non-repudiation.

Integrity. Proof that a specific action occurred and the responsible party cannot deny it. Provided by digital signatures.

Availability. Duplicate systems or components ensure service continues if one fails. Examples: RAID, load balancing, backup ISPs.

Availability. System continues operating even when a component fails. Closely related to redundancy — uses backup components automatically.

Availability. Applying software updates improves stability and closes security holes that attackers exploit to cause outages.

Availability. Floods a system with traffic to prevent legitimate users from accessing it. Does not expose or modify data directly.

Confidentiality. Unauthorized copying or transfer of data to an outside party. Data is disclosed to someone who should not have it.