General Security Concepts · Topic 2 of 7
CIA Triad, AAA and Non-repudiation
Understand the CIA triad, non-repudiation, authentication, authorization and accounting, and how a gap analysis compares current controls to a target.
- 4 min
- Confidentiality, integrity and availability are the three goals. Match each scenario to the goal that is harmed.
- Hashing and digital signatures support integrity. Encryption supports confidentiality. Redundancy supports availability.
- Non-repudiation needs unique identities, digital signatures and trustworthy logs.
What it is
The confidentiality, integrity and availability (CIA) triad names the three goals of information security.
Beside it sit three related ideas.
Non-repudiation stops a person from denying an action. Authentication, authorization and accounting (AAA) describes how a system decides who may do what and keeps a record. A gap analysis compares where an organization is with where it wants to be.
How it works
Confidentiality, integrity and availability
| Goal | Meaning | Typical controls | Attack against it |
|---|---|---|---|
| Confidentiality | Only authorized parties can read the data | Encryption, access control | Data theft, eavesdropping |
| Integrity | Data is accurate and has not been altered without permission | Hashing, digital signatures, version control | Tampering, unauthorized change |
| Availability | Systems and data are usable when needed | Redundancy, backups, patching | Denial of service, hardware failure |
Many scenarios test whether you can tell which goal is harmed.
A stolen customer list harms confidentiality. A changed invoice amount harms integrity. A ransomware outage harms availability.
Non-repudiation
Non-repudiation means a person cannot credibly deny that they performed an action. It is usually built from a digital signature, which ties a message to a private key held by one person, plus reliable logs with timestamps.
A shared account breaks non-repudiation, because the logs cannot show which person acted.
AAA
| Step | Question | Examples |
|---|---|---|
| Authentication | Who are you? | Password, token, fingerprint |
| Authorization | What are you allowed to do? | Permissions, role, access control list |
| Accounting | What did you do? | Audit logs, session records |
Authentication always comes before authorization. Accounting then records both, so that an investigator can review events later.
AAA services for network access are often provided by a central server. The Remote Authentication Dial In User Service (RADIUS) and the Terminal Access Controller Access Control System Plus (TACACS+) are the usual examples.
Authenticating people, systems and devices
People can be authenticated by what they know, have, are or do. Systems and devices need identity too, and they usually prove it with a digital certificate or a key instead of a password.
Authorizing systems means more than checking a person. A server may also need rights to call an application programming interface (API) or read a database, so those rights should follow least privilege like any user account.
Gap analysis
A gap analysis compares the current state of security against a target, such as a framework, a policy or a regulation. The difference is the gap. The result is a list of missing or weak controls, which feeds a plan to close them.
A gap analysis can be done by an internal team or by an outside party. It does not fix anything by itself.
What to remember for the exam
- Confidentiality, integrity and availability are the three goals. Match each scenario to the goal that is harmed.
- Hashing and digital signatures support integrity. Encryption supports confidentiality. Redundancy supports availability.
- Non-repudiation needs unique identities, digital signatures and trustworthy logs.
- AAA order is authenticate, authorize, then account.
- RADIUS and TACACS+ are common central AAA servers for network devices.
- Accounting is about logging and auditing, not about granting access.
- A gap analysis compares the current state with a desired state, and its output is a list of gaps.
- Devices and services need authentication and authorization as well as people.
To find the CIA goal in a scenario, ask what the attacker changed: who can read it (confidentiality), what it says (integrity) or whether it can be reached (availability).
Common mistakes
Mixing authentication with authorization. Logging in proves identity. Permissions decide what the identity can do afterward.
Assuming encryption protects integrity. Encryption hides data, but on its own it does not show whether the data was changed. A hash or a signature is the integrity tool.
Thinking a login proves non-repudiation. If several people share the credentials, nobody can be held to a specific action.
Treating accounting as access control. Logs record what happened. They do not block anything.
Confusing a gap analysis with a vulnerability scan. A scan finds technical weaknesses on systems. A gap analysis compares whole programs or controls to a standard.
Availability is a security goal as well. If a question describes a service that is down because of an attack or a failure, the harmed property is availability, even though no data was stolen.
Check yourself
Which CIA goal does a digital signature mainly support, besides non-repudiation?
Integrity, because any change to the signed data makes the signature check fail.
What is the correct order of the AAA steps?
Authentication, then authorization, then accounting.
What does a gap analysis produce?
A list of differences between the current controls and the target, which is then used to plan remediation.
Topic 2 of 7 in General Security Concepts
Test yourself on General Security Concepts
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.