The CIA triad frames information security around three goals: confidentiality, integrity, and availability. Secure systems and data restrict access and modification to authorized entities while remaining usable when required. section 11.1 section 11.1.1
Apply the three goals to both information and the systems that store, process, transmit, or support it:
- Confidentiality prevents unauthorized entities from accessing systems and data. section 11.1.1
- Integrity keeps systems and data trustworthy and prevents unauthorized alteration during storage or transmission. section 11.1.1
- Availability keeps systems and data accessible and usable by authorized entities when required. section 11.1.1
Map attacks to security goals
A SYN-flood DoS attack targets availability by filling a target's TCP connection table with half-open connections. DHCP exhaustion also harms availability by consuming the server's address pool. ARP poisoning can compromise confidentiality and integrity by enabling interception and alteration of communications. section 11.2.1 section 11.6
Figure 11.1 The CIA triad. Confidentiality protects systems and data from unauthorized access, integrity ensures that systems and data are trustworthy, and availability ensures that systems and data remain available to authorized users.
Use the triad diagram to compare unauthorized access, unauthorized alteration, and loss of authorized access at a glance. section 11.1.1
