UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 2.1 Free with a free account
Confidentiality, Integrity, and Availability — The Three Pillars Every Security Professional Lives By
Ethics in Technology · Chapter 2: The Pillars of Security and Your First Line of DefenseSection 2.1 · lesson 5 of 11613 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: Recognizing the Different Types of Dangers That Target Information Systems →← Why Failing to Protect Information Can Cost Organizations Money, Trust, and ReputationNext lesson: Recognizing the Different Types of Dangers That Target Information Systems →
In this lesson
Protect secrecy, correctness, and usable access together.
- Diagnose confidentiality, integrity, and availability failures
- Select controls for each goal
- Balance competing needs by mission
- Extend the model with authenticity and the Parkerian hexad
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,671 words). Read along, or search it.
The Pillars of Security and Your First Line of Defense
The 3 Pillars of Security
Messages, payment details, and deadline files can fail in three quite different ways. Someone might read them, alter them, or prevent access when they are needed. The CIA triad organizes those concerns as confidentiality, integrity, and availability. The initials simply name these three goals, rather than the intelligence agency. Every control can be connected to one or more goals, making the model a useful diagnostic. We examine failures and protections for each pillar, including deliberate attacks and accidental disruptions. Then a clinic example shows how one incident can affect all three goals. Security settings also create trade-offs, requiring a balance that fits the organization's mission. Authenticity and non-repudiation extend the discussion to genuine origins, and evidence of actions. The Parkerian hexad adds further distinctions, helping us identify losses the basic triad can overlook.
CIA Triad
3 Different Questions About the Same Data
Confidentiality asks who is allowed to know the information, including people, systems, and processes. Integrity asks whether that information is accurate, complete, and free from unauthorized changes. Availability asks whether authorized users can reach and use it, when they need it. On a phone, a stranger reading messages is a confidentiality problem. A changed payment amount is an integrity problem, even if access remains normal. A broken phone before a deadline creates an availability problem, despite information remaining secret and correct. Different questions lead to different protections, rather than one setting that fixes everything. Encryption, change checks, and redundancy each answer a different part of the model. When an incident occurs, first identify which goals were harmed and how. More than one may be involved, so the first answer should not stop the investigation.
Confidentiality
Only Authorized Parties Should See It
Confidentiality protects medical histories, salaries, product plans, and other information intended for restricted access. Disclosure can be deliberate, as with theft or an employee browsing records without a work reason. It can also be accidental, through wrong-recipient email, lost laptops, or publicly exposed cloud storage. Reading someone else's screen over their shoulder is another route, called shoulder surfing. Encryption protects stored or traveling information from readers who do not have the necessary key. Least privilege limits permissions, while stronger authentication reduces dependence on a password alone. Classification labels, training, privacy screens, locks, and secure disposal guide appropriate handling. Privacy concerns appropriate control of personal information; confidentiality describes the holder's protective duty. In twenty seventeen, Equifax's unpatched application flaw exposed information belonging to roughly one hundred forty-seven million people. Systems remaining online did not undo that loss, because exposed secrets cannot simply become secret again.
Integrity Failures
Wrong Information Can Be Quietly Dangerous
Integrity applies to data, system behavior, and messages, rather than only to stored documents. An altered bank balance, prescription, or email can misdirect a decision without stopping normal access. The source illustrates a dose changed from five milligrams to fifty milligrams. That is a dangerous information failure, even though nothing was stolen and the system remains available. Attackers, malicious software, intercepted messages, ordinary errors, and faulty software can all damage integrity. Quiet failures are especially difficult, because people may continue trusting the altered result. Stuxnet, discovered in twenty ten, manipulated centrifuges while presenting normal-looking readings to operators. The machines and the information describing them both lost integrity in that example. In twenty thirteen, a hijacked news-agency account posted a false report of White House explosions. Markets briefly reacted before the report was exposed, illustrating harm from apparently trustworthy but false information.
Integrity Controls
Make Change Detectable and Recoverable
Hashing creates a digital fingerprint, allowing a file's expected contents to be checked for changes. An altered fingerprint reveals a mismatch, though the comparison still needs a trusted reference. Digital signatures combine content checks with cryptographic keys, supporting evidence about signed information. Input validation checks whether entries have the expected form, reducing harmful or inappropriate input. Change control makes modifications deliberate, rather than letting any convenient edit become accepted data. Version history preserves earlier states, helping trace mistakes and return to an appropriate version. Audit logs record activity, so unusual or unauthorized changes can be investigated. Backups support restoration of a correct copy, after files become damaged or incomplete. These controls address different points in the failure, from entry to discovery and recovery. The aim is dependable information, rather than merely proof that nobody copied it.
Availability Failures
Disruption Can Be Malicious or Accidental
Availability means authorized people can access usable systems and information at the necessary time. Deliberate traffic floods can overwhelm a service, while ransomware can lock files people need. Hardware failures, power cuts, disasters, and faulty updates can produce similar loss without an attacker. In October twenty sixteen, the Mirai botnet overwhelmed the infrastructure provider, Dyn, with traffic. Many popular websites became unreachable for parts of that day. In May twenty seventeen, WannaCry spread worldwide, disrupting hospitals in the United Kingdom's National Health Service. Some appointments were canceled, showing how computer access affects real services for people. In July twenty twenty-four, a faulty security-software update affected about eight point five million Windows devices. Flights, banks, and hospitals were disrupted, although that incident did not depend on a hostile attacker. The protective question must cover accidental failures, as well as deliberate attempts to stop access.
Availability Controls
Build Continuity Before the Failure
Redundancy supplies duplicate servers, network links, or power sources, reducing dependence on a single component. Backups and disaster-recovery plans help rebuild systems after ransomware, fire, flood, or other losses. The source describes the familiar three-two-one rule for arranging backup copies. Keep three copies, on two types of media, with one copy located off-site. The point is to avoid one incident removing every useful copy together. Traffic-flood protection and load balancing help absorb or distribute excessive demand on services. Patching closes known weaknesses, while testing updates reduces the risk of the maintenance causing an outage. Uninterruptible power supplies, and generators, support continued operation when ordinary power fails. These protections work across prevention and recovery, because continuity includes surviving a failure. Perfectly secret and accurate information still needs to be reachable, for authorized work to continue.
Clinic Example
A Backup Cannot Undo Disclosure
The clinic example begins when staff cannot open patient files that attackers have encrypted. That is an availability failure, because authorized users cannot reach information required for care. The attackers then publish a sample of stolen patient records online. That is a confidentiality failure, because private records now reach people without permission to see them. Deleted appointment records also create an integrity failure, making the remaining information incomplete. One incident therefore damages all three pillars, through distinct actions and consequences. Restoring last night's offline backup can return access, and a known-good state of the data. It supports availability and integrity, rather than reversing everything that happened. The published patient information remains exposed, even after local systems work correctly again. This is why copying data and locking systems, often called double extortion, require separate parts of the response.
Competing Goals
A Stronger Setting Can Create Another Problem
Controls can strengthen one pillar, while creating difficulty for another pillar. Multi-factor sign-in and short automatic logouts support confidentiality, but can delay urgent access. A two-minute inactivity timeout illustrates how repeated sign-in can interfere with time-critical work. Encryption protects secrets, but losing its key can leave rightful users unable to use their files. Keeping many copies improves access, while adding places from which information could leak. Multiple approval steps protect the integrity of changes, but can delay an urgent correction. Opening a website without login improves access, while potentially exposing information or permitting unwanted changes. These examples show why maximizing every setting is not a complete security strategy. Assess who needs the information, when it is needed, and the consequences of delay or exposure. Then design a balance, rather than treating inconvenience as automatic proof of stronger protection.
Mission-Based Balance
Priorities Reflect the Work Being Protected
Organizations weigh the pillars according to the mission that their information supports. A bank needs correct balances and confidential account information, making both goals central to its work. A hospital must protect privacy, while ensuring correct records are reachable during urgent treatment. A public news website focuses heavily on reliable access and accurate reporting. Those priorities are illustrations, rather than permission for any organization to abandon another pillar. Emergency clinical access can reduce a difficult trade-off through a break-glass arrangement. A clinician can open a necessary record quickly, while the exceptional action is logged and reviewed. That preserves timely access, while accountability helps limit inappropriate use of the exception. Other source examples include quicker sign-in methods, or a longer timeout in a secure area. The lesson is to improve the design of the trade-off, rather than simply accept avoidable harm.
Beyond the Triad
Authenticity and Non-Repudiation
Authenticity asks whether information or an identity is genuine, and from the source it claims. Integrity asks whether the contents changed, which is a different question. A forged letter can remain exactly as its author created it, yet still claim a false origin. Authentication, digital certificates, and sender verification provide evidence relevant to authenticity. A browser's secure connection should not be treated as proof that every website claim is trustworthy. Non-repudiation concerns dependable evidence against denying a performed action, such as approving a transfer. Digital signatures, secure timestamps, and protected audit trails support that evidence. The evidence depends on reliable identity and key handling, rather than a signature being a magical guarantee. For a signed contract, integrity concerns unchanged terms, while non-repudiation concerns evidence of the signing action. Both extensions make transaction and identity questions clearer than the three basic goals alone.
Parkerian Hexad
6 Elements Help Identify Overlooked Losses
In nineteen ninety-eight, security researcher Donn B Parker proposed a six-element model, the Parkerian hexad. It retains confidentiality, integrity, and availability, while adding possession or control, authenticity, and utility. Possession distinguishes control over information, from whether another person has read it. A stolen encrypted laptop can remain confidential, while its rightful owner loses control of the device and data. Authenticity distinguishes genuine origin, as in recognizing a fake invoice copied from a supplier's template. Utility concerns usable form, rather than merely whether information is physically reachable. Archived files can remain intact and accessible, but become useless when their only decryption key is lost. A changed student grade illustrates integrity, while a crashed exam portal illustrates availability. The hexad is useful as a checklist, identifying types of loss the simpler model may conceal. Use the triad to begin diagnosis, then add the distinctions needed to describe the actual harm completely.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About Confidentiality, Integrity, and Availability — The Three Pillars Every Security Professional Lives By
What is the CIA triad in cybersecurity?
What are real examples of attacks on data integrity?
How can one ransomware attack affect confidentiality, integrity, and availability?
What is the Parkerian hexad?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →