The CIA Triad - CompTIA Security+ SY0-701 - 1.2

Main idea

The video explains the CIA Triad (sometimes called the AIC Triad, but “CIA” is used for memorability) as a core framework in information security. It emphasizes three security objectives—Confidentiality, Integrity, and Availability—and provides practical examples of how each is achieved.

CIA Triad (core concepts)

1) Confidentiality (C)

• Goal: Prevent unauthorized access to private/sensitive information.
• Clarification: The “CIA” in this context has nothing to do with the U.S. Central Intelligence Agency.

How confidentiality is provided:

• Encryption
  • One party encrypts data and sends it.
  • The intended recipient decrypts it to view the original plaintext.
  • Anyone intercepting the encrypted data in transit cannot understand its contents.
• Access controls / limiting permissions
  • Restrict who can access certain information.
  • Example: Marketing staff may edit marketing materials, but cannot access accounting information.
• Multi-factor authentication (MFA)
  • Prevents account access unless a user has the correct credentials plus required additional verification.

Relation to the CIA triangle: Confidentiality, Integrity, and Availability are commonly shown as three legs of a triangle representing security objectives.

2) Integrity (I)

• Goal: Ensure data received is exactly the same as what was sent, with no unauthorized changes during transmission.

How integrity is provided:

• Hashing
  • Sender computes a hash of the data and sends both the data and the hash.
  • Receiver recomputes the hash using the same method.
  • If hashes match, the data has not changed.
• Digital signatures (enhanced integrity)
  • A digital signature uses a hash that is encrypted with an asymmetric encryption algorithm.
  • Enables verification that:
    • data has not been altered
    • the sender is the legitimate party (authenticity + integrity)
• Certificates
  • Used to identify devices or people, adding stronger integrity assurances during device-to-device or system-to-system transfers.
• Non-repudiation
  • Provides proof that the information came from the originating party.
  • The receiver can confirm the source without doubt (i.e., the sender cannot credibly deny it).

3) Availability (A)

• Goal: Ensure systems remain up and running so authorized users can access the data they need.

How availability is provided:

• Always-on system design
  • Build systems to be continuously operational.
• Fault tolerance
  • Use multiple components so that if one fails, others can take over and the service continues.
• Ongoing management and patching
  • Regular updates/patches keep systems stable and close security vulnerabilities that could otherwise be exploited to disrupt availability.

Methodology / instructional framing (implied steps)

Use the CIA Triad to guide security thinking:

• Confidentiality: apply encryption, enforce access controls, require MFA.
• Integrity: apply hashing; strengthen with digital signatures and certificates; support non-repudiation.
• Availability: design for uptime, add fault tolerance, and patch systems regularly.

Speakers / sources featured

• No individual speakers or external sources are explicitly identified in the provided subtitles.