General Security Concepts · Topic 1 of 7
CIA Triad, AAA and Non-repudiation
Understand the CIA triad, non-repudiation, and authentication, authorization and accounting (AAA), and match each security scenario to the right goal.
- 4 min
- Confidentiality, integrity and availability are the three goals. Match each scenario to the goal that is harmed.
- Hashing and digital signatures support integrity. Encryption supports confidentiality. Redundancy and backups support availability.
- Non-repudiation needs unique identities, digital signatures and trustworthy logs.
What it is
The confidentiality, integrity and availability (CIA) triad names the three goals of information security. Every control in the exam exists to protect at least one of them.
Two related ideas sit beside the triad. Authentication, authorization and accounting (AAA) describes how a system decides who may do what and keeps a record of it. Non-repudiation stops a person from credibly denying an action they performed.
These ideas are listed under defense in depth in the objectives. Each one is a layer of protection, and they work best together.
How it works
Confidentiality, integrity and availability
| Goal | Meaning | Typical controls | Attack against it |
|---|---|---|---|
| Confidentiality | Only authorized parties can read the data | Encryption, access control | Data theft, eavesdropping |
| Integrity | Data is accurate and has not been altered without permission | Hashing, digital signatures, version control | Tampering, unauthorized change |
| Availability | Systems and data are usable when needed | Redundancy, backups, patching | Denial of service, hardware failure |
Many scenarios test whether you can tell which goal is harmed. A stolen customer list harms confidentiality. A changed invoice amount harms integrity, and a ransomware outage harms availability.
Some events harm more than one goal. Ransomware that also copies files before encrypting them harms both availability and confidentiality.
Balancing the three goals
The goals can pull against each other. Very strict access rules protect confidentiality but can slow down people who need the data, which hurts availability.
Good design picks the balance the business needs. A hospital record system values availability highly, while a payroll file puts more weight on confidentiality and integrity.
Non-repudiation
Non-repudiation means a person cannot credibly deny that they performed an action. It is usually built from a digital signature, which ties a message to a private key held by one person, plus reliable logs with timestamps.
A shared account breaks non-repudiation, because the logs cannot show which person acted. Unique user accounts are the starting point.
| Supports non-repudiation | Weakens non-repudiation |
|---|---|
| Digital signature with a private key held by one person | Shared or generic accounts |
| Unique user identities | Logs that users can edit or delete |
| Protected, time stamped audit logs | Clocks that are not synchronized |
AAA
| Step | Question | Examples |
|---|---|---|
| Authentication | Who are you? | Password, token, fingerprint, certificate |
| Authorization | What are you allowed to do? | Permissions, role, access control list |
| Accounting | What did you do? | Audit logs, session records |
Authentication always comes before authorization. Accounting then records both, so that an investigator can review events later.
Authenticating people, systems and devices
People can be authenticated by something they know, have or are. Systems and devices need identity too, and they usually prove it with a digital certificate or a key instead of a password.
Authorization applies to systems as well. A server may need rights to call an application programming interface (API) or read a database, so those rights should follow least privilege like any user account.
How the exam asks about this
- "An attacker changes the amount on invoices stored in a shared folder." -> Integrity is harmed.
- "Two administrators share one login, and nobody can prove who deleted a file." -> Non-repudiation is missing, so give each person a unique account.
- "A user signs in successfully but cannot open the finance folder." -> Authentication worked, and authorization denied the request.
What to remember for the exam
- Confidentiality, integrity and availability are the three goals. Match each scenario to the goal that is harmed.
- Hashing and digital signatures support integrity. Encryption supports confidentiality. Redundancy and backups support availability.
- Non-repudiation needs unique identities, digital signatures and trustworthy logs.
- The AAA order is authenticate, authorize, then account.
- Accounting is about logging and auditing, not about granting access.
- Devices and services need authentication and authorization as well as people.
- The CIA goals, AAA and non-repudiation are all layers of defense in depth.
To find the CIA goal in a scenario, ask what the attacker changed: who can read it (confidentiality), what it says (integrity) or whether it can be reached (availability).
Common mistakes
Mixing up authentication with authorization. Logging in proves identity. Permissions decide what the identity can do afterward.
Assuming encryption protects integrity. Encryption hides data, but on its own it does not show whether the data was changed. A hash or a signature is the integrity tool.
Thinking a login proves non-repudiation. If several people share the credentials, nobody can be held to a specific action.
Treating accounting as access control. Logs record what happened. They do not block anything.
Forgetting availability. A service that is down because of an attack or a failure is a security problem, even though no data was stolen.
Logs only support non-repudiation if users cannot change them. Send them to a protected central store that the people being logged cannot edit.
Check yourself
Which CIA goal does a digital signature mainly support, besides non-repudiation?
Integrity, because any change to the signed data makes the signature check fail.
What is the correct order of the AAA steps?
Authentication, then authorization, then accounting.
Why does a shared administrator account weaken non-repudiation?
The logs show only the shared account, so no single person can be tied to an action.
Topic 1 of 7 in General Security Concepts
Test yourself on General Security Concepts
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.