CIA and simple attacks

CIA is a simple lens I use to explain what went wrong and what to fix first. Once you can name the impact clearly, choosing controls becomes calmer and more defensible.

To keep this practical, we will use one simple frame. Confidentiality, integrity, and availability are often shortened to CIA. Confidentiality means only the right people can see information. Integrity means changes are correct and visible. Availability means systems are there when needed. The purpose is not to memorise three words. The purpose is to ask better questions.

In plain language, confidentiality is about privacy, integrity is about truth, and availability is about being able to function. Most incidents are one of these three, usually with a second one following close behind.

When identity is weak, confidentiality fails. When changes are untracked, integrity fails. When backups are missing, availability fails. Good governance makes those failures less likely because it makes the decisions explicit and reviewed.

In real organisations, CIA is how you explain impact to non security people. A leader might not care about a vulnerability ID, but they do care about "patients could not be seen" or "invoices were changed" or "private data leaked." CIA translates technical failures into outcomes.

Everyday example. Confidentiality is your bank statement being private, integrity is your balance being correct, and availability is being able to pay for groceries when you are at the checkout.

Common mistake. Thinking CIA is a checklist where you must maximise all three at once. In practice you trade. Tight security might reduce availability if you lock out staff too often. High availability might reduce confidentiality if you spread access too widely. The job is to choose wisely and explain the trade.

Why it matters. CIA is a simple way to reason about controls and to spot what kind of harm you are actually preventing. It helps you avoid security theatre and focus on outcomes.

Entropy Payload