Introduction
Every question you will ever see on a cyber-security exam — whether it asks about firewalls, passwords, encryption, backups, or hacking — is ultimately a question about protecting information. To reason about any security control you first need a clear, shared vocabulary for what we are protecting and against what. That vocabulary is the CIA Triad: Confidentiality, Integrity, and Availability.
The CIA Triad is the single most fundamental model in information security. It is the mental checklist that professionals use to decide whether a system is "secure" and to classify what has gone wrong when it is attacked. For BCS, Bank, and IT-officer written and viva examinations, this is guaranteed high-yield territory: MCQs routinely ask "What does the 'I' in CIA stand for?", "Which principle does encryption primarily protect?", or "A DDoS attack violates which security goal?". Master this lesson and you can answer an entire family of questions with confidence.
Learning objectives
After studying this lesson you should be able to:
- Define information security and explain why it is needed.
- State and explain the three pillars of the CIA Triad — Confidentiality, Integrity, Availability — from first principles.
- Give the type of attack, control, and real-world example for each pillar.
- Explain supporting concepts: Authentication, Authorization, Accounting/Non-repudiation, Identification.
- Distinguish related terms: threat, vulnerability, risk, exploit, attack, asset.
- Apply the triad to classify a given security incident correctly.
- Explain extended models: the DAD triad, Parkerian Hexad, and AAA.
- Avoid the common traps that examiners plant in MCQs.