CIA Triad
What is it?
Confidentiality (السرّية), Integrity (السلامة) and Availability (التوافر) — the three properties every security decision ultimately protects.
Why it matters
Every security control exists to protect one or more of these three. When you can name which property is at risk, you can explain why a finding matters — not just that it looks wrong.
Where you see it
In how a finding gets described: 'this exposes data' (confidentiality), 'this could be silently altered' (integrity), 'this could be taken offline' (availability).
What normal looks like
Data only the right people can read, records that match what was actually entered, and systems that are up when people need them.
What suspicious looks like
Someone outside the payroll team reading salary data (confidentiality), a payroll amount changed with no approval record (integrity), or the payroll system suddenly unreachable at pay time (availability).
How analysts investigate
Name the property first — is this about who can see it, whether it can be trusted, or whether it works — because that decides who you call and how urgently.
Common beginner mistakes
- Assuming every security problem is a confidentiality problem — many real incidents are about integrity or availability instead.
- Treating the three properties as mutually exclusive, when a single incident often damages more than one at once.
NovaCore's payroll system holds salary data, calculates pay, and pays employees on time. Three very different things can go wrong with it — and each has a name.
When more than one property is hit
A single incident often damages more than one property. Ransomware that encrypts payroll files is both an availability failure (nobody can use the files) and, if the attacker also copied them first, a confidentiality failure too.
Quick check
An attacker doesn't read or delete anything, but quietly changes an employee's bank account number on file. Which property is violated?
A quick self-check — it doesn't affect your XP or progress.
One ransomware event, two properties
NovaCore's payroll files are hit by ransomware: the files are encrypted, and investigators find the attacker copied them to an external server first. Name every CIA property affected, in order.
Read the encryption as an availability failure.
The payroll files still exist, but nobody can open them — the payroll team cannot pay staff at pay time. That is availability: the asset is present but unusable. A beginner stops here and calls it 'a ransomware/availability incident'.
Do not stop — check whether the data also left.
A tempting false lead is to treat ransomware as purely availability. But the investigation shows the attacker copied the files out first. That is a confidentiality failure too: salary data — who earns what — is now in someone else's hands. One event, two properties, and the second is easy to miss if you fixate on the encryption.
Let the properties set the response and severity.
Naming both changes what you do: the availability failure means invoke backups and recovery; the confidentiality failure means a data-breach notification path and possibly regulators. Had you named only availability, you would restore the files and never disclose the theft. Naming the CIA properties precisely is what makes the response complete.
Sign in to save your progress on the server.