The CIA and DAD triads

The CIA triad

Security professionals summarise the goals of information security with three words: confidentiality, integrity, and availability. Together they are called the CIA triad, and it has no relation to the American intelligence agency.

Confidentiality

Confidentiality means keeping information private, so that only the people who are allowed to see it can. Locking a folder of salaries so only HR can open it is confidentiality in action.

Integrity

Integrity means information stays accurate and is not changed without permission. When you download a file and it arrives exactly as it was sent, integrity held.

Availability

Availability means the information and systems are there when people need them. A good backup is an availability control: it lets a system come back quickly after a problem.

Warning

The three goals often pull against each other. Locking something down tightly (confidentiality) can make it slower to reach in an emergency (availability). Security is usually about balance, not maximums.

The DAD triad, the flip side

For every goal there is a matching failure. Security people call these the DAD triad:

Goal (CIA)	Failure (DAD)
Confidentiality	Disclosure
Integrity	Alteration
Availability	Destruction

Reading an incident through DAD makes it concrete. A leaked customer list is disclosure. A tampered invoice is alteration. Ransomware that locks your files is destruction of availability.

A quick reading of one scam

Take an email that quietly changes a supplier's bank details. It comes from a look-alike domain (the part after the @, the organisation's address on the internet):

From: accounts@supplier-support.com   (look-alike domain)
"Please update our IBAN before the next payment."

Which part of CIA does it attack? The integrity of the payment information. Naming it is the first step to stopping it.

Try this now

Think of one thing that has gone wrong with data around you: a message someone saw that they should not have, a file that got changed or corrupted, an account you were locked out of. Name which CIA goal it broke (confidentiality, integrity or availability) and its DAD counterpart (disclosure, alteration or destruction). Putting the right word to it is the skill this lesson is building.

Check yourself

Cyber fundamentals

Where this lesson comes from

Built from

Workshop 1: Cybersecurity Essentials (participant guide V3.0): CIA and DAD triads

You can check these yourself

NIST FIPS 199, confidentiality, integrity and availability

alphaPlan identifies whether a lesson comes from a taught programme or was authored for this pathway. Where a claim rests on an outside standard or a reported case, it is named above so you can check it rather than take our word for it.

shënim: ky material u krijua në kuadër të projektit 'U.S. Cybersecurity Leadership in AI for Albania', financuar nga departamenti i shtetit i shteteve të bashkuara. mendimet, gjetjet dhe përfundimet e paraqitura këtu janë të autorit(ëve) dhe nuk pasqyrojnë domosdoshmërisht ato të departamentit të shtetit të shteteve të bashkuara.

Disclaimer: This material was created on behalf of the 'U.S. Cybersecurity Leadership in AI for Albania' project, funded by the United States Department of State. The opinions, findings, and conclusions stated herein are those of the author(s) and do not necessarily reflect those of the United States Department of State.

Disclaimer

Found something unclear, outdated or improvable? Suggest an improvement