Explain the CIA triad. For a university results portal, give one threat and one control for each of the three properties.
Show the explanation
The CIA triad names the three properties that security aims to protect.
| Property | Meaning | Results portal: threat | Results portal: controls |
|---|---|---|---|
| Confidentiality | Only authorised people can read the data. | A student views another student's marks by changing the roll number in the URL (broken access control). | Server-side authorisation on every request ("may this user see this roll number?"), TLS in transit, encryption at rest, least privilege for staff. |
| Integrity | Data is accurate and changed only by authorised people, in authorised ways. | Someone alters marks in the database or in transit. | Role-based write access, input validation, audit logs, database constraints, digital signatures or hashes on published result files, TLS. |
| Availability | Authorised users can get to the data when they need it. | The site crashes on result day from heavy load or a denial-of-service attack. | Load testing, autoscaling or a CDN, rate limiting, backups, redundancy, monitoring and an incident plan. |
Points that strengthen the answer
- The three properties can conflict. Strict access checks and encryption add friction and can reduce availability, so security is about balancing them for the risk involved.
- Related properties often added: authenticity (data really comes from whoever it claims to come from), non-repudiation (the sender cannot later deny an action, usually through digital signatures and logs), and accountability (audit trails). The "Parkerian hexad" extends CIA with possession, authenticity and utility.
- The triad helps in threat modelling: for each asset, ask how its confidentiality, integrity or availability could be harmed, then choose controls (preventive, detective or corrective) to match.
Original UniCircle question. Last reviewed 22 Oct 2026.