Information Security: Confidentiality, Integrity and Availability

The three objectives

US federal law (44 U.S.C. § 3552) and NIST's Federal Information Processing Standard (FIPS) 199 define the security objectives as:

Objective	Definition	Example of loss
Confidentiality	Preserving authorised restrictions on information access and disclosure, including protecting personal privacy and proprietary information	Customer card data stolen
Integrity	Guarding against improper information modification or destruction, including ensuring non-repudiation and authenticity	An attacker changes a supplier's bank account in the vendor master file
Availability	Ensuring timely and reliable access to and use of information	Ransomware takes the ERP system down during the year-end close

Controls for each objective

Confidentiality	Integrity	Availability
Encryption at rest and in transit Role-based access, least privilege Data classification and labelling Data loss prevention tools Secure disposal of media	Hashing and checksums Digital signatures (authenticity and non-repudiation) Input validation and edit checks Change management Audit logs	Redundant systems and failover Backups and tested restoration Capacity monitoring DDoS protection Business continuity and disaster recovery plans

FIPS 199 impact levels

• Low — limited adverse effect on operations, assets or individuals.
• Moderate — serious adverse effect.
• High — severe or catastrophic adverse effect.

Each system is categorised by the highest impact level across the three objectives (the "high-water mark"), which drives the baseline of controls selected from NIST SP 800-53.

Encryption essentials

• Symmetric encryption uses one shared key — fast, used for bulk data (AES).
• Asymmetric encryption uses a public/private key pair — used for key exchange and digital signatures.
• A digital signature is created with the sender's private key and verified with their public key, proving authenticity and integrity.
• A hash is a one-way fingerprint — any change to the data changes the hash.

Link to SOC 2

The AICPA Trust Services Criteria map closely to the triad: security (common criteria), availability, processing integrity, confidentiality and privacy. Privacy is related but distinct — it concerns the collection, use, retention and disposal of personal information according to commitments and law. See SOC 1 vs SOC 2.

Study further in ISC security fundamentals and ISC privacy frameworks.

Sources

• NIST — FIPS 199, Standards for Security Categorization of Federal Information and Information Systems
• NIST — SP 800-53 Rev. 5, Security and Privacy Controls
• NIST Computer Security Resource Center — Glossary
• AICPA & CIMA — 2017 Trust Services Criteria (with revised points of focus, 2022)