1.2 Information Security Core Concepts and CIA Triad
Key Takeaways
- Confidentiality, Integrity, and Availability (the CIA Triad) form the foundation of information security as defined in ISO/IEC 27000.
- Extended security properties include Authenticity, Non-repudiation, Accountability, and Reliability, providing essential depth for auditing modern systems.
- Security engineering inevitably involves trade-offs; increasing confidentiality controls often creates friction with availability or usability.
- A breach of integrity can corrupt organizational decision-making and operational safety even without data leakage.
- Lead Auditors assess security controls by evaluating how effectively they preserve CIA properties relative to organizational asset criticality and risk tolerance.
1.2 Information Security Core Concepts and CIA Triad
At the core of information security management lies the mandate to protect organizational assets from unauthorized access, compromise, disruption, or destruction. ISO/IEC 27000 defines information security as the "preservation of confidentiality, integrity, and availability of information." While these three properties—known universally as the CIA Triad—represent the primary objectives of an ISMS, modern auditing and risk management demand a broader understanding that encompasses extended security properties: Authenticity, Non-repudiation, Accountability, and Reliability.
The CIA Triad: Primary Information Security Pillars
[ Confidentiality ]
/ \
/ \
/ \
/ ISMS \
/ Core \
/ Triad \
[ Integrity ] -------------- [ Availability ]
1. Confidentiality
ISO 27000 Definition: The property that information is not made available or disclosed to unauthorized individuals, entities, or processes.
Confidentiality ensures that sensitive data remains accessible only to authorized personnel. Threats to confidentiality include snooping, shoulder surfing, man-in-the-middle (MitM) eavesdropping, unauthorized data exfiltration, and improper disposal of physical storage media.
- Primary Controls: AES-256 encryption at rest, TLS 1.3 encryption in transit, Role-Based Access Control (RBAC), multi-factor authentication (MFA), data classification schemes, and non-disclosure agreements (NDAs).
- Audit Verification: Lead Auditors review access control matrices, cryptographic key management procedures, and data leakage prevention (DLP) logs to verify confidentiality safeguards.
2. Integrity
ISO 27000 Definition: The property of safeguarding the accuracy and completeness of assets.
Integrity guarantees that data and system configurations have not been modified, tampered with, or corrupted in an unauthorized or accidental manner. A failure of integrity can be far more catastrophic than a loss of confidentiality—for instance, if an attacker silently alters pharmaceutical dosing formulas or financial ledger balances.
- Primary Controls: Cryptographic hash functions (SHA-256), digital signatures, file integrity monitoring (FIM), write-once-read-many (WORM) storage, input validation, and change management workflows.
- Audit Verification: Auditors verify hash comparison logs, segregation of duties in deployment pipelines, and database audit trails.
3. Availability
ISO 27000 Definition: The property of being accessible and usable upon demand by an authorized entity.
Availability ensures that critical systems, networks, applications, and data are operational whenever business processes require them. Threats to availability include Distributed Denial of Service (DDoS) attacks, hardware failures, ransomware encryption, power outages, and natural disasters.
- Primary Controls: Redundant power supplies, high-availability server clusters, load balancing, off-site data backups, disaster recovery (DR) sites, and DDoS mitigation services.
- Audit Verification: Auditors evaluate recovery time objectives (RTO), recovery point objectives (RPO), backup restoration test results, and business continuity exercise reports.
Extended Information Security Concepts
Modern ISMS implementations extend beyond the traditional CIA triad to incorporate additional critical security properties recognized by ISO/IEC 27000:
| Extended Property | ISO Definition & Purpose | Key Technical Control | Audit Evidence |
|---|---|---|---|
| Authenticity | The property that an entity is what it claims to be. Ensures genuine identity verification of users, devices, and messages. | PKI certificates, SAML/OAuth 2.0, biometric verification, digital signatures. | Identity provider audit logs, certificate authority trust chains. |
| Non-repudiation | The ability to prove the occurrence of a claimed event or action and its originating entity, so that the event cannot be denied. | Public key cryptography, timestamping authorities, cryptographically signed logs. | Signed transaction logs, audit trail integrity checks. |
| Accountability | The property that traceably correlates actions to a specific unique entity. Ensures individuals are held responsible for their actions. | Unique user IDs (no shared accounts), centralized SIEM logging, privileged access management (PAM). | User activity logs, PAM session recordings, SIEM event logs. |
| Reliability | The property of consistent intended behavior and performance without failure. | Fault-tolerant design, automated health checks, stress testing. | System uptime SLA reports, performance monitoring logs. |
Security Trade-Offs and Architectural Tension
A central theme in ISO/IEC 27001 lead auditing is evaluating how organizations manage security trade-offs. Security controls do not operate in a vacuum; maximizing one property frequently imposes constraints on another or impairs operational usability.
Common Architectural Trade-Off Scenarios
- Confidentiality vs. Availability: Implementing zero-trust network access with mandatory multi-factor authentication and micro-segmentation protects data confidentiality. However, if the central identity provider suffers an outage, legitimate users are blocked from accessing critical cloud systems, causing a severe availability failure.
- Confidentiality vs. Usability: Forcing multi-layered encryption and strict DLP restrictions on mobile devices prevents data loss but may lead employees to use unsanctioned personal communication tools ("Shadow IT"), introducing unmonitored risk.
- Integrity vs. Performance/Availability: Performing real-time deep-packet inspection and cryptographic signature verification on all inbound network traffic ensures data integrity but increases latency and processing overhead, potentially degrading service availability during peak loads.
Real-World Audit Scenario: Evaluating Triad Controls
Scenario: During an audit of Apex Health Systems, the auditor examines the patient portal database. To achieve high availability, Apex operates dual synchronized databases across two datacenters. However, to maintain low latency, database replication is set to asynchronous. During a minor network disruption, a database failover occurred, resulting in 15 minutes of un-replicated patient data being overwritten with older records.
Auditor Analysis: Apex prioritized Availability (near-zero failover time) over Integrity (data consistency). The un-replicated write operation caused a loss of data integrity and data accuracy. The auditor reviews whether Apex's risk assessment (ISO 27001 Clause 6.1.2) explicitly identified and accepted the risk of asynchronous replication data loss. Because patient records were corrupted without formal risk acceptance or recovery procedures, the auditor identifies a non-conformity against Clause 8.1 (Operational planning and control) and Clause 6.1.2.
An attacker alters a financial firm's database records to increment account balances without authorizing or transferring actual funds. Which core security property has been directly violated?
A enterprise implements digital signatures on all outgoing purchase orders so that executives cannot later deny approving a contract. Which security property does this control demonstrate?
When designing a highly confidential enclave, security engineers require triple-factor authentication and heavy disk encryption. Users report that system responsiveness is significantly degraded and login times have tripled. This scenario illustrates which fundamental security principle?