CIA Triad

Learning Path

📘 Phase 1 – Overview

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand the three principles of the CIA Triad.
Explain how Confidentiality, Integrity, and Availability support business objectives.
Identify AWS services that help implement each principle.
Analyse real-world security incidents using the CIA Triad.
Apply the CIA Triad to enterprise cloud environments.

📚 Lesson Information

Estimated Time: 90 Minutes

Difficulty: Beginner

Prerequisites: Shared Responsibility Model

Hands-on Lab: Yes

Assignment: Yes

💼 Business Value

Every organisation depends on its information being:

Accessible to authorised users.
Accurate and trustworthy.
Protected from unauthorised access.

The CIA Triad provides the foundation for designing secure systems and making informed security decisions.

Cloud Security Engineers use these principles every day when configuring cloud resources, reviewing architectures, and responding to security incidents.

🌍 What is the CIA Triad?

The CIA Triad is a security model that helps organisations protect information.

It consists of three core principles:

              CIA TRIAD

        +-----------------+
        | Confidentiality |
        +-----------------+
                 ▲
                / \
               /   \
              /     \
             /       \
+-----------------+   +-----------------+
|    Integrity    |   |   Availability  |
+-----------------+   +-----------------+

Every security control supports one or more of these principles.

🔒 Confidentiality

Definition

Confidentiality ensures that information is accessible only to authorised users.

The goal is to prevent unauthorised disclosure of sensitive information.

Examples of sensitive data include:

Customer records
Financial information
Medical records
API keys
Passwords
Source code
Encryption keys

Common Threats

Stolen credentials
Phishing
Public cloud storage
Insider threats
Weak passwords
Missing encryption
Misconfigured IAM policies

AWS Security Controls

Examples include:

IAM
Multi-Factor Authentication (MFA)
AWS KMS
Secrets Manager
AWS Organizations SCPs
S3 Bucket Policies
AWS WAF

Enterprise Example

CloudNova Technologies stores customer documents in Amazon S3.

If the bucket becomes publicly accessible, confidential customer information could be exposed.

The business impact includes:

Data breach
Regulatory penalties
Customer trust loss
Financial losses

✅ Integrity

Definition

Integrity ensures that information remains accurate, complete, and trustworthy.

Data should not be modified without authorisation.

Common Threats

Malware
Ransomware
SQL Injection
Insider modification
Accidental deletion
Configuration drift

AWS Security Controls

Examples include:

Versioning
AWS Backup
AWS Config
CloudTrail
Digital Signatures
Hashing
Change Management

Enterprise Example

A malicious user modifies payroll records before salaries are processed.

Although the data is still available, it is no longer trustworthy.

Integrity has been compromised.

🌐 Availability

Definition

Availability ensures that systems and information remain accessible when needed.

Applications should continue operating despite failures or attacks.

Common Threats

Distributed Denial of Service (DDoS)
Hardware failures
Power outages
Ransomware
Accidental deletion
Natural disasters

AWS Security Controls

Examples include:

Multiple Availability Zones
Auto Scaling
Elastic Load Balancer
Amazon Route 53
AWS Backup
AWS Shield
Amazon CloudFront

Enterprise Example

CloudNova Technologies hosts an online banking application.

During a DDoS attack, customers cannot access online banking services.

Even though customer data remains secure, the application is unavailable.

Availability has been compromised.

⚖️ Balancing the CIA Triad

Security often requires balancing all three principles.

Scenario	Confidentiality	Integrity	Availability
Online Banking	High	High	High
Company Blog	Low	Medium	High
Medical Records	High	High	High
Video Streaming Platform	Medium	Medium	High
Internal HR System	High	High	Medium

There is no one-size-fits-all approach.

Security controls should match business requirements.

☁️ CIA Triad in AWS

Principle	Example AWS Services
Confidentiality	IAM, KMS, Secrets Manager, S3 Bucket Policies
Integrity	CloudTrail, AWS Config, Versioning, Backup
Availability	Auto Scaling, ELB, Route 53, Multi-AZ, Shield

Cloud Security Engineers use these services together to achieve a balanced security posture.

🏢 Enterprise Scenario

CloudNova Technologies

CloudNova Technologies hosts an e-commerce platform on AWS.

During a security review, the following issues are identified:

Customer data is stored without encryption.
Application servers run in a single Availability Zone.
CloudTrail logging is disabled.
Backups are not enabled.
IAM users share the same administrator account.

As the Cloud Security Engineer:

Which CIA principle is affected by each issue?
What business risks do these issues introduce?
Which AWS services would you recommend?
Which issue should be remediated first?

🧪 Hands-on Exercise 1 — Protect Confidentiality

Objective

Review the security configuration of an S3 bucket.

Steps

Sign in to the AWS Management Console.
Navigate to Amazon S3.
Select an existing bucket or create a test bucket.
Review:
- Public Access Block settings
- Bucket Policy
- Object permissions
- Default encryption

Questions

Is the bucket publicly accessible?
Is encryption enabled?
Which IAM identities have access?
How would you improve confidentiality?

🧪 Hands-on Exercise 2 — Review Integrity Controls

Objective

Understand how logging supports integrity.

Steps

Open the AWS Console.
Navigate to CloudTrail.
Review existing trails.
Examine recorded events.

Questions

Why is logging important?
How could CloudTrail help during an investigation?
What happens if logging is disabled?

🧪 Hands-on Exercise 3 — Explore High Availability

Objective

Understand how AWS improves availability.

Visit:

https://aws.amazon.com/about-aws/global-infrastructure/

Identify:

AWS Regions
Availability Zones

Questions:

Why deploy applications across multiple Availability Zones?
What happens if one Availability Zone becomes unavailable?
How does redundancy improve business continuity?

🧪 Hands-on Exercise 4 — Check Encryption

Visit:

https://aws.amazon.com/kms/

Review:

What AWS Key Management Service (KMS) does.
Types of encryption keys.
Services that integrate with KMS.

Questions:

Why should sensitive data be encrypted?
What happens if encryption keys are compromised?

🧪 Hands-on Exercise 5 — CIA Classification Challenge

For each asset below, identify which CIA principle is most important.

Asset	Confidentiality	Integrity	Availability
Payroll Database	⭐⭐⭐	⭐⭐⭐	⭐⭐
Public Website	⭐	⭐	⭐⭐⭐
Banking System	⭐⭐⭐	⭐⭐⭐	⭐⭐⭐
Marketing Blog	⭐	⭐	⭐⭐
Medical Records	⭐⭐⭐	⭐⭐⭐	⭐⭐

Discuss why different systems require different security priorities.

📊 Knowledge Check

Answer the following questions:

What does the CIA Triad represent?
Define Confidentiality.
Define Integrity.
Define Availability.
Give three AWS services that improve Confidentiality.
Give three AWS services that improve Integrity.
Give three AWS services that improve Availability.
Why must organisations balance all three principles?

📝 Assignment

Prepare a CIA Triad Assessment Report for CloudNova Technologies.

Include:

Explanation of the CIA Triad.
Business importance of each principle.
Threats affecting Confidentiality, Integrity, and Availability.
AWS services that support each principle.
Recommendations for improving the organisation’s security posture.

Length: 2–3 pages.

💡 Key Takeaways

After completing this lesson, you should understand:

The CIA Triad is the foundation of information security.
Every security decision supports Confidentiality, Integrity, Availability, or a combination of all three.
Different business systems require different security priorities.
AWS provides services that help organisations implement all three principles.
Cloud Security Engineers use the CIA Triad to evaluate architectures, investigate incidents, and recommend security controls.

📚 Further Reading

AWS Security Best Practices
AWS Well-Architected Framework – Security Pillar
NIST Cybersecurity Framework
CIS Controls v8
ISO/IEC 27001 Information Security Controls

🚀 Next Lesson

➡️ Identity & Access Fundamentals