Security Concepts · Topic 1 of 8
The CIA Triad and Defense in Depth
Learn the CIA triad of confidentiality, integrity and availability, and how defense in depth layers several controls so one failure is not fatal.
- 4 min
- CIA stands for confidentiality, integrity and availability.
- Encryption mainly supports confidentiality.
- Hashes and digital signatures mainly support integrity.
What it is
The CIA triad names the three goals of information security, and defense in depth is the strategy of protecting them with many layers.
CIA stands for confidentiality, integrity and availability. Almost every security control exists to support at least one of these three goals.
Defense in depth assumes that any single control can fail. By stacking several independent controls, an attacker who beats one layer still meets the next.
How it works
Each CIA goal has typical threats and typical controls, and each layer of defense in depth adds controls of a different kind.
The three goals
| Goal | Meaning | Typical threat | Typical control |
|---|---|---|---|
| Confidentiality | Only authorised parties can read the data | Eavesdropping, data theft | Encryption, access control |
| Integrity | Data is accurate and has not been changed without permission | Tampering, malicious edits | Hashing, digital signatures, change control |
| Availability | Systems and data can be used when needed | Denial of service, hardware failure | Redundancy, backups, DoS protection |
The goals can pull against each other. A very strict access policy helps confidentiality but can slow down the people who need the data.
Confidentiality
Confidentiality keeps data away from people who should not see it.
Encryption protects data in transit and at rest. Access control lists and strong authentication limit who can open a file or reach a server.
Integrity
Integrity means the data you read is the data that was written.
A hash gives a short fingerprint of a file. If the file changes, the hash changes, so a mismatch shows tampering. A digital signature goes further because it also proves who signed the data.
Availability
Availability means that authorised users can reach the service when they need it.
Attacks such as denial of service target availability directly. Redundant links, spare hardware, backups and load balancing all help keep services running.
Defense in depth
Defense in depth places controls at several layers, and no layer is trusted on its own.
Common layers include:
- Policy and training so people know the rules and can spot attacks
- Perimeter controls such as firewalls and intrusion prevention
- Network controls such as segmentation, access control lists and network access control
- Host controls such as endpoint protection, patching and host firewalls
- Application controls such as input checking and secure coding
- Data controls such as encryption, backups and data loss prevention
The layers should be different in kind. Two firewalls from the same vendor with the same flaw are weaker than a firewall plus an endpoint agent plus segmentation.
Related ideas often appear with this strategy. Least privilege gives each user only the access needed for the job. Segmentation limits how far an intruder can move after getting in.
A simple example shows the idea. A phishing email passes the mail filter, but the endpoint protection blocks the malicious attachment. If that fails too, segmentation keeps the infected laptop away from the database servers.
What to remember for the exam
Seven facts cover most questions on this topic.
- CIA stands for confidentiality, integrity and availability.
- Encryption mainly supports confidentiality.
- Hashes and digital signatures mainly support integrity.
- Redundancy, backups and DoS protection mainly support availability.
- Denial of service is an attack on availability.
- Defense in depth uses several layers of different controls, so one failure is not fatal.
- Least privilege and segmentation both support a layered design.
When a question describes data being changed, think integrity. When it describes data being seen, think confidentiality. When it describes a service being down, think availability.
Common mistakes
These four errors appear often.
Mixing up integrity and confidentiality. Encryption hides data but does not by itself prove it was not altered. Hashes and signatures are the integrity tools.
Treating defense in depth as buying more of the same product. The layers should be different and independent, so one flaw does not break them all.
Thinking a perimeter firewall is enough. An attacker who gets past it, or an insider, meets no further control. Host and network controls cover that gap.
Forgetting that availability is a security goal. Backups and redundancy are security controls, not only operations tasks.
Do not trade one goal away without noticing. Locking data down so tightly that nobody can use it fails the availability goal.
Check yourself
Work through these three questions.
Which CIA goal is attacked by a denial of service?
Availability, because the attack stops authorised users from reaching the service.
Which tools mainly support integrity?
Hashes and digital signatures. A changed file gives a different hash, and a signature also shows who signed.
Why does defense in depth use several different layers?
Any single control can fail. Different layers mean an attacker who beats one still meets the next.
Topic 1 of 8 in Security Concepts
Test yourself on Security Concepts
The full Cisco CCNA 200-201 CBROPS question bank has 754 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.