Network security basics: the CIA triad and practical controls

The CIA triad and AAA

Confidentiality restricts reading to authorised parties, using measures such as access permissions and encrypted VPN or HTTPS connections. Integrity protects against unnoticed changes, supported by hashes such as SHA-256 and digital signatures. Availability keeps systems usable when needed, with measures such as redundancy, high availability and protection against denial of service.

AAA separates three questions. Authentication establishes identity using passwords, tokens or biometrics, including multifactor methods. Authorisation determines permitted actions, such as access to VLAN 10 or SSH. Accounting records relevant activity so administrators can establish who changed what and when.

The CIA triad is a decision model

A control can support several goals or create a trade-off. A very restrictive firewall may protect confidentiality but damage availability when configured incorrectly. Assess the required protection and consequences of failure for each system.

A public status document has different confidentiality needs from credentials but may still require strong integrity. This context prevents applying identical controls everywhere without reference to the risk.

Risk depends on context

A vulnerability is an exploitable weakness; a threat is a possible actor or trigger. Risk combines likelihood and impact in the actual environment. An open management port in an isolated laboratory differs from one on the internet. Controls reduce likelihood, impact or both, while an accountable owner must decide how to handle residual risk.

Defence in depth combines identity, segmentation, secure configuration, patching, logging, backups and incident response. The layers should be sufficiently independent that one failed control does not immediately compromise everything.

• Man-in-the-middle: an attacker reads or changes communication between parties; authenticated encryption, certificate checking and sound key management reduce the risk.
• Denial of service: excess requests overwhelm a system; rate limits and firewalls are among the available controls.
• Phishing: deceptive requests steal credentials; training and MFA reduce exposure.
• Brute force: repeated password guessing; strong passwords and appropriate account lockout controls help.

Prove controls in operation

A written policy does not protect devices configured differently. Baselines, regular scans, central logs and tests show whether the intended control is effective. Firewall, routing and identity changes need traceable review and a rollback plan.

Prepared roles, communication channels and usable timestamps matter during an incident. Exercises uncover missing access, incomplete logs and unclear decisions before a real attack exploits them.