Cybersecurity basics: the CIA triad
In short: Security protects three things: confidentiality (only the right people can see data), integrity (data isn't changed wrongly) and availability (systems work when needed).
The three goals
| Goal | Meaning | Example of an attack | Example of a protection |
|---|---|---|---|
| Confidentiality | Only authorised people can see the information | A stolen laptop with unencrypted files | Encryption, passwords and MFA, access permissions |
| Integrity | Information is accurate and not changed without permission | Someone alters bank details on an invoice | Hashes, digital signatures, change logs, backups |
| Availability | Systems and data work when people need them | Ransomware or a flood of fake traffic (DDoS) | Backups, redundancy, DDoS protection, patching |
Using the triad in real life
Ask three questions about anything you protect, whether a server, a file or a Wi-Fi network:
- Who should be able to see it, and is everyone else blocked?
- How would I know if it was changed wrongly, and can I undo it?
- What happens if it stops working, and how fast can I recover?
Balance matters
Security choices often trade one goal against another. Very strict access improves confidentiality but can hurt availability if people get locked out. Good security finds the right balance for the business.
Real-world example: pupil records at a school
A school keeps pupil records in an online system: names, home addresses, medical notes and grades. All three goals matter, in different ways.
- Confidentiality: only the right staff should see a pupil's medical notes. A teacher does not need every pupil's home address, so permissions limit who sees what.
- Integrity: grades must not change without a trace. If a mark is edited, the system should record who changed it and when, so a mistake or tampering can be spotted and put right.
- Availability: on results day, or when a pupil has an allergic reaction and staff need their medical notes quickly, the system must simply work.
Notice the balance: forcing a new login every five minutes might protect confidentiality, but it would get in the way of availability in an emergency.
Try this: pick one account you rely on, such as your email, and ask the three questions about it. Which of the three would hurt you most if it failed?
Key takeaways
- Confidentiality: only the right people can see data.
- Integrity: data stays accurate and unaltered.
- Availability: systems work when needed.
- Ask the three questions about anything you protect.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.