The CIA triad is the foundational model for thinking about security. Memorize it — every control you ever design maps back to it.
Keeping data secret from those who shouldn't see it.
Ensuring data is accurate and unaltered.
Ensuring systems and data are accessible when needed.
Often a fourth idea is added: non-repudiation — proof that an action genuinely came from a specific actor (via digital signatures and audit logs).
Layer controls so that a single failure doesn't lead to compromise. Network firewall + host firewall + endpoint detection + least privilege + monitoring — each layer buys time and visibility.
Give every user, process, and service the minimum access required to do its job — nothing more. The most over-granted permission is the one an attacker will abuse.
"Never trust, always verify." Assume the network is already breached. Authenticate and authorize every request, regardless of where it originates.
When a system errors, it should default to denying access, not granting it. A crashed auth service must not "fail open."
No single person should control an entire critical process end-to-end. The developer who writes code shouldn't be the only one who approves and deploys it.
Complexity is the enemy of security. Every extra feature, port, and integration is more attack surface to defend.
| A | Meaning |
|---|---|
| Authentication | Who are you? (prove identity) |
| Authorization | What are you allowed to do? |
| Accounting | What did you actually do? (logging/audit) |
Keep the triad and these principles in your head as a checklist. When evaluating any system, ask: Which CIA goal does this protect, and which principle does it uphold?