The triad is the floor, not the ceiling
Most operational models build on CIA with three more properties:
- Authenticity: a message can be proven to come from the claimed sender. Digital signatures give this; passwords usually do not.
- Non-repudiation: the sender cannot later deny sending. A consequence of authenticity plus a tamper-evident log.
- Accountability: every action ties to an identity. Requires logging plus authentication for every privileged operation, plus a log store the actor cannot rewrite.
Some frameworks add privacy as a fourth pillar. Others fold it under confidentiality with stricter scoping. The Parkerian Hexad adds possession and utility on top, useful when reasoning about ransomware where the data is intact and confidential but unreachable.
Quantitative risk in one line
Annualized Loss Expectancy: ALE = SLE × ARO. SLE is single-loss expectancy (dollars per incident), ARO is annualized rate of occurrence. A $1M incident expected once every 5 years has ALE = $200k. A control that reduces ARO from 0.2 to 0.05 saves $150k/year. If it costs $80k, it pays for itself.
The numbers are usually rough. The discipline of writing them down is the actual point. It forces explicit assumptions about probability and impact, which makes the resulting decision auditable.
Defense in depth
Pick controls so that any single failure does not break the property you care about. Encryption at rest plus encryption in transit plus access control plus audit logs plus alerting on anomalies. A well-layered system can survive any one control failing without the breach becoming a disaster.
The trap: each layer must be independent. If two layers fail the same way (both rely on the same vault credential, both trust the same TLS root, both share a single secret), defense in depth becomes defense in width.
Bell-LaPadula and Biba: formal but useful
Two classical models worth knowing the names of:
- Bell-LaPadula: confidentiality model. "No read up, no write down." A subject cleared at SECRET cannot read TOP SECRET, and cannot write to UNCLASSIFIED (which would leak). The basis for multi-level secure systems.
- Biba: integrity model. "No read down, no write up." A high-integrity process cannot read low-integrity data (which could corrupt its decisions) and a low-integrity actor cannot write to high-integrity stores.
You will rarely implement either directly outside a defence or research context. But "no write down" and "no write up" are useful intuitions: data integrity and confidentiality have natural flow-control rules that simple access lists miss.
Security objectives by domain
"Secure" is not one thing. Different industries weight the pillars differently:
- Healthcare: integrity first (wrong dosage kills), then confidentiality (HIPAA), then availability. Hospitals would rather a record be unreadable than wrong.
- Banking: integrity and non-repudiation first. A correct, attributable balance matters more than a fast one.
- Media / news: availability and integrity. A news site that goes down or whose content can be edited loses trust quickly.
- Critical infrastructure: availability often outranks confidentiality. A grid operator cannot afford controls that lock operators out during an emergency.
Where the triad fails
The original CIA does not address some modern concerns directly:
- Privacy as separation from confidentiality: data the user does not want collected at all, not just kept secret.
- Safety: physical-world consequences (autonomous vehicles, medical devices).
- Resilience: ability to degrade gracefully under partial failure, distinct from up-time.
Newer frameworks (NIST CSF 2.0, MITRE Engenuity) keep CIA as a foundation but add governance, risk management, and resilience as first-class concerns.