Open any security textbook and the CIA triad appears on page one: Confidentiality, Integrity, Availability. It's usually presented as a definition to memorise, which undersells it badly. The triad is better understood as a complete answer to a deceptively simple question: how many fundamentally different ways can something go wrong with information? The answer turns out to be three.
The three failures
- Confidentiality fails when the wrong people see it. A leaked salary spreadsheet, a stolen customer database, someone reading your screen on the train. The information is intact and accessible — it just reached eyes it shouldn't have.
- Integrity fails when the information is changed — or can't be trusted to be unchanged. An attacker altering an invoice's bank details, a corrupted database, a tampered log file. Nothing leaked; something worse happened: you can no longer believe what you're reading.
- Availability fails when the right people can't get to it. Ransomware locking every file, a DDoS attack flattening a website, or — no attacker required — a failed disk with no backup. Secrecy and accuracy are worthless if nobody can reach the thing.
Every incident you'll ever read about is one of these, or a combination. Ransomware is an availability attack (with confidentiality bolted on, once attackers began stealing data before encrypting it). Phishing usually targets confidentiality. Invoice fraud is an integrity attack. The triad isn't a slogan — it's a sorting system that works on everything.
Here's what the textbook page rarely says: the three pull against each other. Maximum confidentiality (encrypt everything, lock everything down) hurts availability. Maximum availability (everyone can access everything, always) shreds confidentiality. Real security work isn't maximising all three — it's choosing the right balance for each system, deliberately.
Why this is genuinely useful on day one
Two reasons. First, it gives you the professional's opening question. When someone says "make this system secure," the working translation is: secure against which failure? A public website's priority is availability and integrity — confidentiality barely applies to public pages. A payroll database inverts that completely. Same word, "secure"; different triad weights; different controls.
Second, it explains decisions that otherwise look like bureaucracy. Why backups are a security control (availability). Why file hashes and audit logs exist (integrity). Why the annoying access reviews happen (confidentiality). Once you can name which corner of the triangle a control defends, security stops looking like a pile of arbitrary rules and starts looking like a system.