At 7:10 on a Monday morning, a clinic's scheduling server stops answering. Nobody's records were read and nothing was altered, but no patient can be booked and the front desk is turning people away. The data is perfectly secret and perfectly accurate, and the clinic still has a serious security incident.
That example is why security people describe their job in terms of three properties, not one: confidentiality, integrity and availability, known as the CIA triad. On the CompTIA Security+ SY0-801 exam the triad sits under objective 1.1, which expects you to explain the core concepts every control is built on. This lesson defines each property, shows what failure looks like, and teaches you how to read a scenario and name the property at stake.
Every security control protects at least one of three properties
The CIA triad is a way to describe what security is for. Any control you'll meet in this course, from a firewall rule to a background check, exists to protect one or more of these:
- Confidentiality: only authorized people, processes and systems can read the data.
- Integrity: the data and systems are accurate and haven't been changed without authorization.
- Availability: authorized users can reach the data and systems when they need them.
Attacks can be described the same way, as the opposite of each property. Some texts call this the DAD triad: disclosure breaks confidentiality, alteration breaks integrity, and destruction or denial breaks availability. When you analyze an incident, the first question is which of these happened. That tells you how serious it is, which controls failed, and what to fix.
The triad also gives you a common language with the business. A manager may not care about TLS cipher suites, but they understand "customer data could be read by outsiders" or "orders can't be placed for four hours".
Confidentiality keeps data away from people who shouldn't see it
Confidentiality failures are what most people picture when they hear "breach": a database dumped onto a leak site, an email sent to the wrong recipient, a cloud storage bucket left open to the internet. The data still exists and is still correct, but the wrong people now have it, and you can't take that back.
The controls that protect confidentiality limit who can read data and make data useless to anyone who gets it without permission:
- Encryption at rest and in transit, so stolen disks and captured traffic can't be read.
- Access controls and least privilege, so each account can read only what its job needs.
- Authentication, including multifactor authentication, so an attacker can't simply claim to be an authorized user.
- Data classification and labeling, so people know which information needs protection.
- Physical controls such as privacy screens and locked rooms, which stop shoulder surfing and theft.
Confidentiality isn't the same as privacy, though they overlap. Privacy is about personal information and the rights people have over it. Confidentiality applies to any sensitive data, including trade secrets, source code and network diagrams that contain nothing personal.
On the job, confidentiality problems often come from configuration rather than clever attacks. An overly broad file share, a service account with read access to everything, or a test database filled with real customer records are all confidentiality failures waiting to happen.