1.1.2. The CIA Triad as an Analyst's Compass
💡 First Principle: Every security incident ultimately impacts Confidentiality, Integrity, or Availability — and knowing which is affected tells you what kind of damage has occurred, what the attacker's likely goal was, and which recovery actions matter most.
The CIA Triad isn't just a definition to memorize. It's a classification system that gives analysts a consistent language for describing what was harmed and why it matters.
Confidentiality — unauthorized access to data. Breached by: data exfiltration, credential theft, eavesdropping. Attacker goal: steal information. Recovery priority: determine what was accessed and for how long.
Integrity — unauthorized modification of data or systems. Breached by: data tampering, malware that alters configurations, supply chain attacks. Attacker goal: manipulate outcomes (financial fraud, false sensor readings, corrupted backups). Recovery priority: verify which data can be trusted and restore from known-good state.
Availability — preventing legitimate access to systems or data. Breached by: ransomware, DDoS attacks, destructive malware. Attacker goal: extortion, disruption, or operational harm. Recovery priority: restore service, and then determine how the attacker got in.
For vulnerability prioritization, CIA impact scores are built directly into CVSS (the scoring system covered in Phase 3). A vulnerability that enables remote code execution primarily threatens all three. A misconfigured read-only API threatens only confidentiality. Understanding which is at risk shapes remediation urgency.
| Attack Example | Primary CIA Impact | Secondary Impact |
|---|---|---|
| Ransomware | Availability (can't access files) | Confidentiality (data may be exfiltrated first) |
| Credential theft | Confidentiality | Integrity (attacker can modify data once in) |
| SQL injection | Confidentiality | Integrity (can modify/delete records) |
| DDoS | Availability | — |
| Log tampering | Integrity | Confidentiality (hides what attacker accessed) |
⚠️ Exam Trap: Ransomware is primarily an Availability attack — the data isn't necessarily stolen (though modern ransomware often exfiltrates first, making it also a Confidentiality attack). On the exam, read carefully: "encrypted files and demanded payment" = Availability. "Exfiltrated data and threatened to publish" = Confidentiality.
Reflection Question: An attacker modifies financial records in a database without triggering any alerts. Which CIA pillar is most directly violated, and why does this type of attack often go undetected longer than a ransomware attack?
