The CIA and DAD triads

The CIA triad

Security professionals summarise the goals of information security with three words: confidentiality, integrity, and availability. Together they are called the CIA triad, and it has no relation to the agency.

Confidentiality

Confidentiality means keeping information private, so that only the people who are allowed to see it can. Locking a folder of salaries so only HR can open it is confidentiality in action.

Integrity

Integrity means information stays accurate and is not changed without permission. When you download a file and it arrives exactly as it was sent, integrity held.

Availability

Availability means the information and systems are there when people need them. A good backup is an availability control: it lets a system come back quickly after a problem.

Warning

The three goals often pull against each other. Locking something down tightly (confidentiality) can make it slower to reach in an emergency (availability). Security is usually about balance, not maximums.

The DAD triad, the flip side

For every goal there is a matching failure. Security people call these the DAD triad:

Goal (CIA)	Failure (DAD)
Confidentiality	Disclosure
Integrity	Alteration
Availability	Destruction

Reading an incident through DAD makes it concrete. A leaked customer list is disclosure. A tampered invoice is alteration. Ransomware that locks your files is destruction of availability.

A quick reading of one scam

Take an email that quietly changes a supplier's bank details:

From: accounts@supplier-support.com   (look-alike domain)
"Please update our IBAN before the next payment."

Which part of CIA does it attack? The integrity of the payment information. Naming it is the first step to stopping it.

Try this now

Think of one thing that has gone wrong with data around you: a message someone saw that they should not have, a file that got changed or corrupted, an account you were locked out of. Name which CIA goal it broke (confidentiality, integrity or availability) and its DAD counterpart (disclosure, alteration or destruction). Putting the right word to it is the skill this lesson is building.

Check yourself

Cyber fundamentals

shënim: ky material u krijua në kuadër të projektit 'U.S. Cybersecurity Leadership in AI for Albania', financuar nga departamenti i shtetit i shteteve të bashkuara. mendimet, gjetjet dhe përfundimet e paraqitura këtu janë të autorit(ëve) dhe nuk pasqyrojnë domosdoshmërisht ato të departamentit të shtetit të shteteve të bashkuara.

Disclaimer: This material was created on behalf of the 'U.S. Cybersecurity Leadership in AI for Albania' project, funded by the United States Department of State. The opinions, findings, and conclusions stated herein are those of the author(s) and do not necessarily reflect those of the United States Department of State.

Disclaimer

Found something unclear, outdated or improvable? Suggest an improvement