CIA and DAD Triads
The CIA and DAD are cybersecurity concepts describing the essential objectives and threats to a system.
The CIA triad describes the three major objectives in securing a system. These are confidentiality, integrity, and availability. Confidentiality is important when considering access to data. Unauthorized actors should not be given access to data even if it seems harmless to do so. Integrity refers to the structure of the system itself. If a component of the infrastructure is compromised, then the entire system could be damaged. This objective is about protecting against data, hardware, system, and intellectual property loss. Finally, availability concerns the uptime of a system. In any mission critical environment, it is essential that the system is accessible at all times. This is increasingly important for web applications deployed in the cloud. DDoS attacks can prevent users from accessing the application costing money or endangering mission critical operations. The CIA triad defines a scope for robust goals.
The DAD triad describes the three major threats against a system. These are disclosure, alteration, and denial. Each of these is the threat to the corresponding members of the CIA triad. That is to say, disclosure threatens confidentiality, alteration threatens integrity, and denial threatens availability. This direct mapping provides a convenient tool for considering issues with cybersecurity. For instance, the triads can be turned into questions helpful when considering if an objective was achieved: “Does the public server have the potential to disclose confidential information to unauthorized individuals?” Although not comprehensive of all potential issues to be considered in risk assessment, the DAD triad is useful when determining potential threat vectors.
These triads are guidelines rather than rigid categories. Most objectives and threats will fall into all of the categories. However, they are still helpful in scoping and creating a goal. When considering that a DDoS attack could jeopardize availability and integrity, the impact of the threat may be considered elevated. This could cause a decision to be made that more money should be spent on a commercial solution or that additional safeguards need to be placed to ensure system integrity in the event of an attack.
Sources
M. Chapple and D. Seidl, CompTIA security+ study guide: Exam SY0-601, 8th ed. Indianapolis, IN: Sybex, 2021.
FAQs
“The CIA triad does not prepare the users in any shape or form to tackle inexperienced end-users. While people with malicious intents are different, there should be a fail-safe for inexperienced people. A cybersecurity infrastructure should also account for its users and their basic understanding of cybersecurity.
What is the difference between the CIA triad and the dad triad? ›
The CIA triad may also be described by its opposite: Disclosure, Alteration, and Destruction (DAD). Disclosure is the unauthorized disclosure of information; alteration is the unauthorized modification of data; destruction is making systems unavailable.
What are the passwords in the CIA triad? ›
All three parts of the CIA triad apply to password policy- confidentiality, integrity, and availability. Passwords must be kept secret, they must stay the way they've been set, and the authentication software on the backend must be available.
Why is the CIA triad incomplete? ›
What makes the CIA Triad obsolete and incomplete? It is obsolete because it is information security–centric, and it only considers there to be three categories of threats against security, and which only require three services to defend against those threats.
Why the CIA triad is outdated? ›
With the rise of Artificial Intelligence (AI) and autonomous technologies, the traditional Confidentiality, Integrity & Availability "CIA Triad" further demonstrates its insufficiency due to its avoidance of a safety component for cybersecurity practices.
Are triads still active? ›
Triads are also active in other regions with significant overseas-Chinese populations: Macau, Taiwan, Hong Kong, the United States, Canada, Japan, Australia, the United Kingdom, Germany, France, Italy, Brazil, Peru, and Argentina. They are often involved in migrant smuggling.
What is the CIA triad in real life? ›
The CIA Triad of confidentiality, integrity, and availability is regarded as the foundation of data security. Each security control and vulnerability can be evaluated in the context of one or more of these basic principles. It is quite easy to safeguard data important to you.
Which CIA triad is most important? ›
The CIA triad goal of confidentiality is more important than the other goals when the value of the information depends on limiting access to it. For example, information confidentiality is more important than integrity or availability in the case of proprietary information of a company.
What is the opposite of the CIA triad? ›
What Is the Inverse of Confidentiality, Integrity and Availability? The opposite of confidentiality, integrity and availability is disclosure, alteration and destruction.
What are the 4 types of security controls? ›
One of the easiest and most straightforward models for classifying controls is by type: physical, technical, or administrative, and by function: preventative, detective, and corrective.
What part of the CIA triad has been broken? Explain. Integrity; The trust between the two parties was compromised when the bill was changed from $80 to $8.
Which Cannot be maintained without integrity in the CIA triad? ›
Without object integrity, confidentiality cannot be maintained. Integrity means the inability of an object to be modified without permission. Organizations need to evaluate the level of confidentiality they wish to enforce on objects.
Why is the CIA triad important? ›
Importance of CIA Triad
The CIA triad is crucial to information security since it enriches security posture, enables organizations stay obedient with complex regulations, and guarantees business continuity. The contrary of confidentiality, integrity, and availability is disclosure, alteration, and destruction.
What does the CIA triad not include? ›
Explanation: CIA refers to Confidentiality, Integrity, and Availability that are also considered as the CIA triad. However, the CIA triad does not involve Authenticity.
