The CIA Triad?

The CIA Triad: Confidentiality, Integrity and Availability

At the heart of information security sits a simple but powerful framework known as the CIA Triad. It describes three fundamental properties that every organisation must protect in relation to its information and systems. Understanding these three principles is the starting point for any cyber security strategy.

Confidentiality

Information is only accessible to those who are authorised to see it. Sensitive data must be protected from unauthorised disclosure.

From a manager’s perspective: who in your team has access to customer data, financial records or HR information? Are access rights reviewed regularly? Breaches of confidentiality can expose your organisation to significant legal and reputational risk.

Integrity

Information is accurate, complete and has not been altered without authorisation. Data must be trustworthy from creation through to use.

From a manager’s perspective: if an attacker manipulates financial data, changes a procurement record or alters a customer’s order, the consequences can be severe. Processes must ensure data cannot be modified without authorisation and that changes are logged and auditable.

Availability

Systems and data are accessible to authorised users when they need them. Downtime, whether from attack or failure, has real business consequences.

From a manager’s perspective: a ransomware attack that locks your team out of critical systems could halt operations entirely. Business continuity planning, backup systems and incident response procedures are all part of protecting availability.

Insight: Balancing the Three Principles

The three elements of the CIA Triad can sometimes be in tension with one another. For example, very strict access controls improve confidentiality but may reduce availability if staff cannot access systems quickly when they need to. A manager’s role often involves making proportionate, context-aware decisions that balance all three principles rather than maximising any one of them in isolation.

The CIA Triad is intentionally broad. It does not prescribe specific tools or technologies; it provides a way of thinking about what you are trying to protect and why. When evaluating any security decision, a useful question is: does this action help protect the confidentiality, integrity or availability of our information and systems?

CIA Triad Case Study: The Marriott International Data Breach (2014–2018)

Marriott International, the world’s largest hotel chain, discovered in September 2018 that the guest reservation database it had inherited through its 2016 acquisition of Starwood Hotels had been compromised by attackers since July 2014, more than four years earlier. By the time the breach was publicly disclosed in November 2018, it had exposed the personal data of approximately 500 million guests, including names, addresses, passport numbers, dates of birth and encrypted payment card details. This case illustrates all three elements of the CIA Triad and what happens when each one fails.

Confidentiality failed. Attackers gained unauthorised access to Starwood’s guest reservation database using a remote access trojan, eventually harvesting user credentials and escalating their privileges to access highly sensitive personal data, including passport numbers, on hundreds of millions of customers.

Integrity was compromised. Investigators found that attackers had been quietly copying and encrypting guest data over an extended period to exfiltrate it without detection, meaning Marriott could no longer be fully confident in the trustworthiness of its own data environment.

Availability was not the primary failure here, but the consequences were severe nonetheless. The case is most instructive as a confidentiality and integrity failure, but it underlines a wider availability lesson too: due diligence and system integration during mergers and acquisitions are a recurring blind spot, since Marriott did not complete a thorough cybersecurity audit of Starwood’s systems before the acquisition, allowing a pre-existing compromise to persist undetected for years inside its own infrastructure.

The consequences were significant and global in reach. The UK’s Information Commissioner’s Office fined Marriott £18.4 million under GDPR for failing to implement appropriate technical and organisational measures to protect personal data. In the United States, the Federal Trade Commission required Marriott to implement a comprehensive information security programme and pay $52 million across 49 states, after finding that the company had failed to implement reasonable password controls and access controls.

For more information about this case study, click here