Explain the CIA triad and why it matters in information security.

• A. Authentication, Authorization, Accounting.
• B. Confidentiality, Integrity, Availability; foundational objectives guiding controls and risk.
• C. Confidentiality, Anonymity, Availability.
• D. Integrity, Availability, Auditing.

Answer: (B)

The main idea here is the CIA triad, three fundamental objectives that guide information security. Confidentiality is about keeping data away from anyone who isn’t authorized to see it. This is achieved with protections like encryption and strict access controls so sensitive information isn’t exposed. Integrity ensures that data remains accurate and trustworthy; it involves methods such as hashing, digital signatures, and tamper-evident logs to detect and prevent unauthorized changes. Availability means that data and services are accessible to authorized users when they need them, which is supported by redundancy, backups, fault tolerance, and solid incident response.

Why this matters: security decisions are really about meeting these three goals, and they help you prioritize and design controls. If confidentiality fails, you’ve exposed data you shouldn’t; if integrity is compromised, information may be corrupted or forged; if availability is lost, essential services stop, impacting users and operations. The triad provides a clear framework for evaluating risk and deciding where to invest in protections.

Other choices mix in concepts like authentication, anonymity, or auditing, which are related to security but are not the three objectives of the CIA triad itself. The CIA triad remains the concise framework used to shape policies, controls, and risk assessment in information security.