8.1 CIA Triad & Security Goals

Cybersecurity is not a pile of disconnected tools — firewalls, passwords, antivirus, and encryption. Those tools exist to protect three foundational goals: Confidentiality, Integrity, and Availability. Together they form the CIA triad, the vocabulary every Cyber Test (CT) candidate and every cyber operator uses to describe what security is trying to achieve.

If you can name which pillar a scenario threatens or protects, you can reason about the right control even when the question uses unfamiliar jargon. That skill matters for the CT and for cyber AFSCs where mission risk is framed in CIA terms daily.

The Triad at a Glance

These pillars overlap in the real world, but exam items usually have a primary focus. Train yourself to pick the best fit, not every possible fit.

---

Confidentiality

Confidentiality means information is disclosed only to authorized people, processes, or systems. In a military cyber context, that includes classified mission data, personally identifiable information (PII) on personnel systems, cryptographic keys, network diagrams, and even the fact that a particular defensive action is underway.

Mission Example: Classified Traffic and Need-to-Know

An Air Force cyber operator supporting a protected network segment must keep mission traffic confidential. Even someone with a clearance may lack need-to-know for a specific operation. Confidentiality controls enforce both identity (who you are) and authorization (what you may access).

Common Confidentiality Controls

• Access control — accounts, roles, permissions, and least privilege so users get only what their duty requires
• Encryption — scrambling data at rest (disk, databases) and in transit (TLS, VPNs) so intercepted bits are useless without keys
• Classification and labeling — marking data so handlers know handling rules
• Physical controls — badges, locked spaces, TEMPEST-aware practices where electromagnetic leakage matters
• Non-disclosure and OPSEC — human processes that keep sensitive details out of open channels

Breach pattern: An attacker who exfiltrates an unencrypted database of user credentials has primarily violated confidentiality — even if the systems remain up and the data values were not changed.

---

Integrity

Integrity means data and systems remain accurate, complete, and trustworthy — modified only by authorized parties through authorized processes. For cyber missions, integrity covers configuration baselines, sensor telemetry, command-and-control messages, software binaries, and audit logs that investigators rely on after an incident.

Mission Example: Tampered Defensive Telemetry

Suppose an adversary alters intrusion-detection alerts so that a real beacon looks like a false positive, or injects fake “all clear” status into a dashboard. Systems may still be available and the data may still be “secret” from outsiders — but decision-makers are acting on corrupted truth. That is an integrity failure, and it can be more dangerous than a simple outage because operators trust bad information.

Common Integrity Controls

• Cryptographic hashes — digests that change if even one bit of a file changes
• Digital signatures and MACs — prove origin and detect modification of messages or software updates
• Change management and baselines — approve and track configuration changes; alert on drift
• Version control and code review — protect software integrity before deployment
• Immutable or write-once logging — make it hard for an intruder to erase their tracks

Breach pattern: Ransomware that encrypts files also destroys availability, but the act of altering every file’s contents is simultaneously an integrity attack. Exam questions that emphasize “unauthorized modification” or “forged records” point to integrity first.

---

Availability

Availability means authorized users can access systems and data when the mission requires them. Cyber warfare and cyber defense both care intensely about uptime: a perfectly confidential, perfectly intact network that is offline during a critical window has failed its purpose.

Mission Example: Keeping C2 Reachable

A defensive cyber team protecting a command-and-control (C2) path cannot “secure” the path by shutting it off indefinitely. Mission owners need communications. Availability controls keep the path up under load, failure, and attack — while other controls protect confidentiality and integrity of the traffic that flows on it.

Common Availability Controls

• Redundancy — backup links, failover servers, geographically distributed sites
• Backups and recovery plans — restore from known-good copies after destruction or ransomware
• Patching and capacity planning — reduce crashes and resource exhaustion
• DDoS mitigation — absorb or filter floods that try to exhaust bandwidth or compute
• Maintenance windows and SLA thinking — balance upgrades against operational need

Breach pattern: A volumetric denial-of-service attack that floods a public-facing service primarily targets availability. The data may remain confidential and unmodified — users simply cannot reach it.

---

Trade-offs and Extended Goals

Real security design balances the triad. Extreme confidentiality (air-gapping every system) can crush availability for collaborative missions. Aggressive availability (open remote access everywhere) can weaken confidentiality. Integrity checks that block every unsigned update can delay emergency patches.

You may also hear related goals:

• Authentication — proving identity (supports confidentiality and integrity)
• Authorization — deciding what an authenticated identity may do
• Non-repudiation — preventing someone from denying an action (often via signatures and audit trails)
• Accountability — tying actions to actors through logging

These support the triad; they do not replace it. On the CT, if a question asks for the primary security goal, answer with Confidentiality, Integrity, or Availability unless the item explicitly asks for authentication or another supporting concept.

---

Diagnosing Scenarios (Exam Skill)

Use this quick filter:

1. Was information revealed to the wrong party? → Confidentiality
2. Was information or a system changed without authorization (or trust broken)? → Integrity
3. Were authorized users blocked from using a needed resource? → Availability

Mini Scenarios

• Stolen laptop with unencrypted mission notes → Confidentiality
• Attacker flips a single bit in a software update so malware installs → Integrity (and later availability/confidentiality consequences)
• Flood of packets takes a helpdesk portal offline before a deployment → Availability
• Insider copies classified briefing slides to a personal cloud drive → Confidentiality
• Adversary edits firewall rules to allow their C2 channel while leaving the firewall “up” → primarily Integrity of the security configuration (with confidentiality impact on traffic that now leaks)

Practice naming the pillar before you name the tool. Tools change; the triad does not.