The instructor is ready

Information Security Foundations CIA

Interactive digital-human course

Information Security Foundations CIA

Name: Information Security Foundations CIA
Availability: InStock

This training introduces the fundamentals of information security, focusing on the core principles of confidentiality, integrity, and availability.

My workspace28 minFree to watch

What you’ll learn

01Information Security Foundations: Confidentiality, Integrity, and AvailabilityWelcome. In this session, we’re going to build a foundation for talking about information security. The goal is simple: to give you a clear, shared vocabulary, especially around three core goals you’ll hear again and again. Those three goals are confidentiality, integrity, and availability. Together, they form what professionals call the CIA triad. Think of it as a central model that helps us protect data and systems from unauthorized access, use, disclosure, disruption, modification, or destruction. A shared language like this is what bridges the gap between technical teams and business teams when we discuss risk. Today, we’ll walk through each element of the triad, see how they interact, explore some real-world trade-offs, and practice applying the vocabulary. Let’s get started by looking at why this triad matters to you.nvlpubs.nist.gov nccoe.nist.gov nccoe.nist.gov+21 min
02Why the CIA Triad Matters to YouNow that we have introduced the three goals, let us talk about why the CIA triad matters directly to you. Think of the triad as a simple checklist. Whenever you handle information, you can ask yourself three questions. Is the data kept confidential, visible only to the right people? Is the data’s integrity maintained, meaning it is accurate and has not been tampered with? And is the data available, accessible when and where it is needed? This checklist is not just for IT specialists. It gives everyone in the organization a shared vocabulary. When you talk to a technical team about protecting customer details, you are both really talking about confidentiality. When you worry about a spreadsheet being correct, you are talking about integrity. This shared language bridges the gap between business and technology. It also reframes security as a business enabler. When we protect information properly, we build trust with our customers and partners, and we can operate without disruption. Security is not just a technical problem to be solved. Every employee plays a role in protecting these three principles. Next, we will take a closer look at the first pillar: What is confidentiality?nvlpubs.nist.gov nccoe.nist.gov nccoe.nist.gov+22 min
03What Is Confidentiality?Now let's explore the first core goal: confidentiality. In information security, confidentiality means preventing unauthorized disclosure of information. Simply put, it is about keeping secrets secret. This applies whether your data is at rest, like files stored on a hard drive, in transit, like emails traveling across the internet, or in use, actively being processed by an application. To protect confidentiality, we rely on core controls like encryption, which scrambles data so only authorized parties can read it, access controls that limit who can see what, authentication to verify a user's identity, and labels that mark how sensitive information is. You already see confidentiality in everyday life. Think of a locked filing cabinet, the password you use to unlock your phone, or a private messaging app that hides your conversation from others. These are all practical examples of the same principle. Next, we will see how confidentiality applies in a real-world scenario.nvlpubs.nist.gov nccoe.nist.gov nccoe.nist.gov+21 min
04Confidentiality in the Real WorldNow, let's look at a real-world failure of confidentiality. Think about the Change Healthcare attack in early 2024. Hackers used a stolen username and password to break into a system that lacked multi-factor authentication, or MFA. Once inside, they stole private health data affecting over 100 million people. That data included diagnoses, Social Security numbers, and even financial details. Why does this matter? Because that information can be used for identity theft, causing harm that lasts for years. To protect confidentiality, we need to apply a few simple practices. Use strong, unique passwords. Always enable MFA, which adds a second verification step, like a code from your phone. Lock your screen when you step away, even for a moment. And before you share any document, pause and ask yourself: who should have access to this? That one question is the heart of confidentiality. Next, we'll explore the second core goal: what is integrity?techcrunch.com bleepingcomputer.com alyx.sh+22 min
05What Is Integrity?Now let’s talk about integrity. Integrity means guarding against improper modification or destruction of information, and making sure data stays authentic and accurate. In everyday terms, integrity is about trust: you need to know that your data hasn’t been changed in a way that’s unexpected or unauthorized. Changes can happen accidentally, through hardware errors or simple human mistakes. They can also be malicious, like when someone tampers with records or launches a ransomware attack that alters your files. To protect integrity, we use tools like hashing and checksums, which create a unique fingerprint of the data so you can detect any change. Version control, audit logs, and digital signatures also help track who did what and when. In the physical world, think of tamper-evident seals on medicine bottles, or the way bank reconciliation confirms that financial records match reality. Even setting a document to read-only is a simple integrity control. Up next, we’ll look at what happens when integrity fails and the real-world impact of those failures.nvlpubs.nist.gov nccoe.nist.gov nccoe.nist.gov+22 min
06Integrity Failures and Their ImpactNow let's look at a few real cases where integrity was broken—and what happened as a result. In early 2024, the Change Healthcare ransomware attack corrupted critical healthcare data. Over one hundred million patient records were exposed or altered, leaving doctors unable to trust the diagnoses and treatment plans in their own systems. Shortly after, the Snowflake attacks showed a different kind of integrity failure: stolen credentials allowed attackers to access customer data, creating the risk of tampering. When data is changed without your knowledge, every decision based on it becomes unreliable. That is why integrity is trust. On a practical level, you can protect it by verifying data before you act, using version history for key documents, and reporting unexpected changes immediately. If something looks off, speak up. Compromised data leads to compromised decisions. Next, we will explore the third core goal: what is availability?techcrunch.com bleepingcomputer.com alyx.sh+22 min
07What Is Availability?Now let's look at the third core goal: availability. Availability means ensuring timely and reliable access to information and systems when authorized users need them. It's not just about keeping the lights on. We distinguish between planned downtime, like scheduled maintenance, and unplanned outages, which stem from attacks, hardware failures, or natural disasters. To protect availability, organizations rely on basic controls such as redundancy, backups, disaster recovery planning, and DDoS protection. Think about relatable examples. Cloud sync services keep your files accessible across devices. Hospitals rely on backup generators to keep life-saving equipment running during power failures. For e-commerce, uptime directly translates to revenue. Without availability, confidentiality and integrity lose their value because the information simply isn't there when you need it. Next, we'll explore what happens when availability is lost.nvlpubs.nist.gov nccoe.nist.gov nccoe.nist.gov+21 min
08When Availability Is LostNow, let's look at the other side of the same coin: when availability is lost. It's not just about a website being down; it's about the ability to perform your job functions grinding to a halt. Think of the Change Healthcare outage earlier this year. A ransomware attack shut down their systems, and suddenly, insurance claims and pharmacy transactions couldn't be processed, nationwide. Doctors and patients were left in the dark. The Internet Archive suffered a different kind of availability loss in 2024, getting hit by a DDoS attack to overwhelm its servers, even while a separate data breach was happening. To protect this goal, you need to know your backup procedures and report any outage immediately. It's also wise to have an offline alternative for critical tasks. Remember, availability means your tools and data are accessible and reliably working, so you can do your job. Next, we'll see how these three goals, confidentiality, integrity, and availability, often involve trade-offs in the real world, in a section called The CIA Triad in Practice: Trade-Offs.techcrunch.com bleepingcomputer.com alyx.sh+22 min
09The CIA Triad in Practice: Trade-OffsNow, a natural question arises: can we just maximize all three goals at once? Unfortunately, security goals often pull in opposite directions. Strengthening one can weaken another. Let's look at a few examples. If you apply very strong encryption to protect confidentiality, the extra processing can slow down the system, which reduces availability. On the other hand, if you design a system for always-on access to maximize availability, you might simplify the login process by removing an extra authentication step. That trade-off directly weakens confidentiality. The key is that there is no universal perfect setting. The right balance depends on your business context and your risk appetite, which is simply how much risk your organization is willing to accept. A public website needs high availability, while a financial database demands high confidentiality. In the next slide, we'll go deeper into identifying CIA priorities for different assets.csrc.nist.gov csrc.nist.gov nvlpubs.nist.gov+21 min
10Identifying CIA Priorities for Different AssetsWe've now explored the three core goals: confidentiality, integrity, and availability. But in practice, not every piece of data needs the same level of protection in each of those areas. Think about a public website. You want everyone to see it, so confidentiality is low. But you absolutely need the information on it to be accurate and you need the site to be up and running, so integrity and availability are high. Now compare that to a payroll database. That information is highly sensitive, so confidentiality is high. The numbers must be perfectly correct, so integrity is high. But if the payroll system is down for a few hours for maintenance, that's a manageable disruption, so availability is moderate. That's the key lesson here. The same organization will have different priorities, or different 'CIA profiles', for each type of data. A public website, a payroll database, medical records, and source code all have very different needs. In our next slide we'll formalize this idea with a common vocabulary: understanding impact levels.csrc.nist.gov csrc.nist.gov nvlpubs.nist.gov+22 min
11Understanding Impact LevelsNow that we understand the three goals—confidentiality, integrity, and availability—let's talk about how we measure the potential impact if any of these are lost. We use three impact levels: low, moderate, and high. A low impact means the loss would have a limited adverse effect—like a minor slowdown in your work or a small, manageable financial cost. The organization can still perform its primary functions, but the effectiveness is noticeably reduced. A moderate impact is more serious. Here, the loss causes a significant degradation in your mission capability or a significant financial loss. The organization can still function, but its effectiveness is seriously reduced. A high impact is the most severe. It describes a catastrophic effect, such as a complete loss of mission capability or major financial damage. The organization may not be able to perform one or more of its primary functions. So, how do we use these levels for a whole system? We use a concept called the high water mark. An information system often handles many types of data, each with its own impact levels for confidentiality, integrity, and availability. The overall system impact level is simply the highest value among all of them. For example, if a system’s confidentiality is moderate, its integrity is low, and its availability is high, the system’s overall impact level is high. This ensures we protect the system against the worst-case scenario. Next, we’ll explore some common terminology that goes beyond the core triad.csrc.nist.gov csrc.nist.gov nvlpubs.nist.gov+22 min
12Common Terminology Beyond the TriadNow, let's look at a few more terms that work closely with the CIA triad. First, authentication. This is simply proving you are who you say you are, like using a password or a fingerprint. Next, authorization. Once your identity is confirmed, authorization defines exactly what you are allowed to access or do. We also have non-repudiation. This means you cannot deny an action you performed, which is often achieved through a digital signature. Finally, privacy. This is about controlling how your personal data gets collected and shared. These concepts do not replace the core goals of confidentiality, integrity, and availability. Instead, they support and extend them in everyday practice. Next, we will apply the CIA vocabulary we have built.nvlpubs.nist.gov nccoe.nist.gov nccoe.nist.gov+21 min
13Applying the CIA VocabularyNow let's see how to put the CIA vocabulary into practice. Using these terms consistently helps you describe security concerns with precision and clarity, even if you're not a technical expert. Imagine a phishing email tricks someone into revealing their password. We would describe this as a breach of confidentiality. An unauthorized person gained access to private information. Here's a different scenario. A hard drive fails and no backup exists. That's a loss of availability. The information is intact, but no one can reach it when it's needed. When you raise concerns in meetings using this language—saying a risk threatens confidentiality, integrity, or availability—you create a shared vocabulary. This bridges the gap between technical teams and business stakeholders, making security conversations faster, clearer, and more actionable. Next, we'll wrap up with a summary and key takeaways.1 min
14Summary and Key TakeawaysWe've reached the end of our session, so let's quickly recap the most important ideas. The core of information security is the C I A triad: Confidentiality, Integrity, and Availability. Think of these as three goals that every security decision must balance. Trade-offs are normal; protecting one goal might require adjusting another. As you go forward, remember three simple questions you can ask about any information or system: Is it confidential? Is it accurate? And, is it available? Finally, don't forget to use the one-page reference card we discussed. It includes the definitions of each goal and the impact levels we covered, from low to moderate to high, so you can quickly describe the severity of a security concern. Thank you for your time and attention. You now have a practical vocabulary to talk about information security with confidence.csrc.nist.gov csrc.nist.gov nvlpubs.nist.gov+22 min

Sources consulted

Web sources consulted while building this course.