CIA triad and simple attacks

Module 1 introduced the CIA triad as the foundational model for what cybersecurity protects. This module goes deeper: for each property, you will see how a real attack violated it, what specific controls would have prevented the breach, and how to classify new attacks you encounter against the framework.

Confidentiality is the assurance that information is accessible only to those authorised to access it. Violations occur when data is read, copied, or transmitted without authorisation, whether intentionally through theft or accidentally through misconfiguration. Controls include encryption, access restrictions, and the data classification policies Module 3 introduced.

In September 2017, Equifax disclosed that attackers accessed the personal data of approximately 147 million people, including Social Security numbers, birth dates, and addresses. The attackers exploited an unpatched Apache Struts vulnerability (CVE-2017-5638, known since March 2017) and moved laterally through Equifax's systems for 76 days before detection. This is a textbook confidentiality violation: data read and exfiltrated by parties with no authorisation.

Integrity means ensuring data is accurate and has not been altered without authorisation. Integrity attacks modify, delete, or fabricate data. The 2016 Bangladesh Bank SWIFT attack, covered in Module 3, was an integrity attack: fraudulent transfer instructions were inserted into a legitimate transaction workflow without any data being stolen.

Availability ensures systems and data are accessible when needed by authorised users. The WannaCry attack against the NHS in May 2017 was primarily an availability attack: systems were encrypted and made inaccessible, with no data exfiltration involved. DDoS (Distributed Denial-of-Service) attacks, ransomware, and hardware failures all target availability.

The three properties are not independent goals you maximise separately; they pull against each other. Aggressive account lockouts protect confidentiality but hand an attacker a cheap availability weapon: fail five logins on purpose and the legitimate user is locked out. Encrypting everything protects confidentiality, but if the keys are lost the encryption destroys availability more thoroughly than most attackers could. Integrity checks that block suspect transactions also delay honest ones. That tension is why the two standards quoted below treat the properties as a set: NIST gives each one a precise failure meaning, and ISO 27001 warns that protecting one at the expense of another creates exploitable weaknesses. A control that buys one property by quietly selling another has not made the system safer. It has moved the weak point.

The CIA triad describes what attackers aim to violate. STRIDE describes the attack mechanisms they use to do it. Developed at Microsoft in the late 1990s, STRIDE provides a structured vocabulary for identifying threats to any system or component during design.

Each letter represents a threat category. Spoofing means claiming a false identity. A phishing email that appears to come from your bank is spoofing. Tampering means modifying data without authorisation: altering a database record, intercepting a network message, or corrupting a file. Repudiation means denying having performed an action, a threat that audit logging is designed to counter.

Information disclosure covers unauthorised access to data, whether through intentional exfiltration or accidental exposure of a misconfigured S3 bucket. Denial of service covers disrupting availability, from a volumetric DDoS to ransomware that encrypts files. Elevation of privilege means gaining capabilities beyond what is authorised, such as a regular user account gaining administrative rights through a local privilege escalation vulnerability.

Using STRIDE is less formal than the acronym suggests. Take any system you can sketch on a whiteboard, point at each part in turn (the login page, the database, the connection between them, the admin console) and ask six questions: can someone pretend to be this, change it, deny having used it, read it, take it down, or gain rights through it? The questions feel mechanical, and that is their value. They force you to consider threats you would not have imagined unprompted, before a single line of code exists. The applied stage of this course turns this habit into a formal design method with data-flow diagrams; for now, the six questions are enough.

In the Uber breach, STRIDE maps cleanly: the initial credential purchase and MFA fatigue constitute Spoofing (a false identity claim made to defeat authentication). Finding plaintext credentials in a network share represents Information disclosure. Accessing the HackerOne programme meant the attacker gained visibility into unreported vulnerabilities, constituting further Information disclosure and potential Elevation of privilege. Taking systems offline to contain the breach was Uber's response to the Denial-of-service risk created by the attacker's access.

With the framework established, classifying common attack types becomes straightforward. Each type primarily targets one CIA property, though complex attacks often touch multiple. The paragraphs below walk through the most common families, each anchored to a documented incident, and the matrix at the end of the section lines six of them up against the three properties so the pattern is visible at a glance.

Ransomware primarily targets availability by encrypting files and making them inaccessible, as WannaCry did to the NHS in 2017. Some variants also exfiltrate data before encrypting (double extortion), adding a confidentiality violation. The primary business impact is usually operational disruption from lost availability.

Data exfiltrationprimarily targets confidentiality. The attacker copies data and removes it from the organisation's control. The original data may remain in place; the violation is in the unauthorised disclosure.

Man-in-the-Middle attacks (MitM) intercept communications between two parties. They can violate both confidentiality (reading intercepted data) and integrity (modifying messages before forwarding them). TLS, covered in Module 4, is designed specifically to prevent MitM attacks by authenticating the server and encrypting all traffic.

DDoS attacks primarily target availability by overwhelming a system with traffic until legitimate requests cannot be served. They do not typically involve data access or modification. In October 2016 the Mirai botnet, assembled from hijacked home routers and cameras, overwhelmed the DNS provider Dyn and made major websites unreachable across much of the United States for hours, without reading or altering a single record.

SQL injectionattacks insert malicious SQL (Structured Query Language) code into database queries through unsanitised user input. Depending on the payload, they can violate all three CIA properties: exfiltrating data (confidentiality), modifying or deleting records (integrity), or crashing the database service (availability). The Cl0p group's 2023 campaign against the MOVEit Transfer product started with exactly this kind of flaw (CVE-2023-34362) and turned it into mass data theft from organisations worldwide, a CVE you will meet again in the terminal exercise below.

Phishing credential theftprimarily targets confidentiality: the attacker harvests a password or a live session and reads whatever the account can read. In 2022, attackers sent text messages to Twilio employees posing as the company's IT department, collected credentials on a fake sign-in page, and used them to reach internal tools and a subset of customer data. Nothing was encrypted and no service went down; the harm was disclosure. A stolen credential is also the standard first link in longer attack chains, which is why the matrix marks integrity as a secondary concern: once inside, an attacker can usually start changing things.

Supply-chain compromiseattacks you through something you install and trust. In the SolarWinds case, disclosed in December 2020, attackers compromised the vendor's build system and hid a backdoor inside a signed, legitimate software update; SolarWinds estimated that up to 18,000 customers downloaded it. The matrix marks both confidentiality and integrity as primary, because the backdoor was tampered software used to read data inside trusted networks. It is the hardest family to classify from the victim's side, because the malicious change arrives through the same channel as every honest update.

The triad is the core of the definition of information security, but the standard that defines it is careful to say it is not the whole of it. Two further properties matter as soon as systems have to prove things rather than merely protect them: authenticity, the assurance that a party or a piece of data is what it claims to be, and non-repudiation, the assurance that an action, once taken, cannot plausibly be denied later.

You have already met both properties without naming them. Authenticity is what the TLS certificate from Module 4 actually provides: proof that you are talking to the server you meant to reach, before any encryption of the conversation matters. Non-repudiation is what a well kept audit log provides: a protected record that a specific account approved a specific payment at a specific time. The hashing and HMAC controls from Module 3 are close cousins, and the difference is who they convince. An integrity check convinces you that data has not changed. Non-repudiation must convince a third party, months later, possibly in a dispute, which is why it leans on digital signatures and tamper-evident logs rather than private checksums.

Seen this way, STRIDE stops looking like an arbitrary list of six and starts looking like what it was designed as: the attack-side mirror of six desired properties. Spoofing attacks authenticity. Tampering attacks integrity. Repudiation attacks non-repudiation. Information disclosure attacks confidentiality. Denial of service attacks availability. Elevation of privilege attacks authorisation, the rule set that decides what an authenticated identity is allowed to do. Three of the six targets sit outside the triad, which is the clearest evidence that the triad is a working core rather than a complete list. The classifier that follows keeps to the core: it gives you five documented incidents and asks you to name the primary triad property each one violated.

The terminal session above closed on the point this section makes general: classification is only useful because decisions depend on it. Two kinds do. Before any incident, the ranking of the three properties for a given system decides where the money and the engineering effort go. During an incident, the classification of what is being violated decides the first hour of the response.

Rank by mission, not by habit. A hospital ranks availability first: WannaCry forced NHS trusts to cancel more than 19,000 appointments, and the clinical risk came from systems being down, not from anything the attackers read. A credit bureau ranks confidentiality first: Equifax's systems stayed up throughout its 2017 breach, and it remains one of the most damaging incidents on record purely because of what was disclosed. A payment network ranks integrity first: the Bangladesh Bank attackers from Module 3 stole no data and broke no services; they inserted fraudulent instructions, and $81 million left through transactions the system processed faithfully. Same triad, three different orderings, each correct for its system.

The ranking is a spending plan, not a poster. Availability-first systems buy tested offline backups, spare capacity and DDoS absorption before anything exotic. Confidentiality-first systems buy encryption, tight access control and monitoring of who read what. Integrity-first systems buy the controls Module 3 taught: hashing, HMAC verification, reconciliation against a known-good source, and alerts when the two disagree. Every security budget is finite, and the honest way to spend one is to know which property your mission can least afford to lose.

During an incident the same classification sets the playbook. A confidentiality breach makes scoping the priority: what exactly was read, over what period, and does the disclosure trigger a duty to notify a regulator or the people affected. An integrity breach makes trust the priority: nothing the system says can be believed until it has been reconciled against a source the attacker could not reach, which is why the log-tampering pattern in the quiz below is so serious. An availability incident makes restoration the priority, with one caution the impatient learn the hard way: restoring service before removing the attacker simply schedules the next outage.