What is the CIA Triad

Summary

The video explains the CIA triad, a framework for evaluating security through three goals:

• Confidentiality: Only authorized users should be able to access information or resources. Measures may include authentication, authorization, multifactor authentication, and encryption. The speaker distinguishes confidentiality from broader modern ideas of privacy, such as notice, consent, and the right to be forgotten.
• Integrity: Information should remain accurate and trustworthy. Integrity controls detect tampering and alert people—for example, if an attacker changes an order record or edits logs to hide their activity.
• Availability: Authorized users should be able to access systems and resources when needed. A denial-of-service attack, which overwhelms a system with traffic, is an example of a threat to availability.

Practical takeaway: Use the three principles as a checklist when planning a security project, and confirm that confidentiality, integrity, and availability risks have each been addressed.

Main speaker/source: Jeff Crume, speaking for IBM Technology.