The CIA triad — unicorn

In a nutshell All of information security stands on three goals: keep data secret, keep it unaltered, and keep it available. Their initials — Confidentiality, Integrity, Availability — make the CIA triad. Every attack breaks at least one of them, and every defence protects at least one. Name the pillar, and any security topic falls into place.

Three goals, one triangle — lose any corner and the data is no longer secure.

The three pillars

Confidentiality — only those allowed can read the data. Broken by a leak, a sniffed password, a stolen database. Integrity — the data isn't changed by anyone unauthorized, and if it is, you notice. Broken by a tampered transfer, a forged record, a planted file. Availability — the data and service are there when needed. Broken by a DDoS, ransomware, or a pulled cable.

Analogy — a letter. Confidentiality is the sealed envelope (nobody reads it on the way). Integrity is the wax seal (you'd see if it was opened and re-glued). Availability is the postal service running at all (the letter actually gets delivered).

What breaks and what defends each

Pillar	Real-world break	Defended by
Confidentiality	2013 Target breach — 40M card numbers read	encryption, access control, least privilege
Integrity	a bank transfer's amount changed in transit	hashing, digital signatures, checksums, logging
Availability	2016 Dyn DDoS took down half the US internet	backups, redundancy, rate-limiting, DDoS filtering

The tension — you can't max all three

The pillars pull against each other, and security is the balance:

Lock it down hard

strong confidentiality
every access checked
but: slower, harder to reach — availability suffers

Make it instant & open

great availability
friction-free
but: looser access — confidentiality suffers

Good design decides which pillar matters most for this data. A public homepage prizes availability; a password vault prizes confidentiality and integrity; a bank ledger prizes integrity above all.

Where it shows up in real decisions

HTTPS instead of HTTP        → confidentiality + integrity in transit
store password HASHES        → confidentiality even if the DB leaks
tested backups + restore     → availability against ransomware
file hashes + audit logs     → integrity: tampering leaves a trace
rate-limiting on a login     → availability (anti-DoS) + slows brute-force

Habit worth building When you read about any new attack, immediately name the pillar it breaks. Ransomware? Availability (and often confidentiality via the leak-threat). SQL injection dumping a table? Confidentiality. A defaced page? Integrity. That one reflex organizes the entire field in your head.

Beyond the triad

Two extras you'll meet that the classic three don't cover:

Authenticity — is this really who/what it claims to be? (a certificate, a signature)
Non-repudiation — can someone later deny they did it? (signed logs prove they can't)

They matter — but almost everything still reduces to protecting one of the three core pillars. Start there.