Web Security Web Security Introduction The CIA Triad: Confidentiality, Integrity, and Availability

Web Security Beginner 1 min read

The CIA Triad: Confidentiality, Integrity, and Availability

The CIA triad is the foundational model of information security. Confidentiality ensures that data is accessible only to those authorised to see it — enforced through encryption, access controls, and authentication mechanisms. Integrity guarantees that data has not been altered in an unauthorised or unexpected way, protected by hashing, digital signatures, and audit logs. Availability means that systems and data are accessible to legitimate users when needed, defended through redundancy, backups, and denial-of-service protections. Every security control, policy, and decision in web development can be mapped back to one or more pillars of the CIA triad. A SQL injection attack violates confidentiality and integrity by exposing or modifying database records. A ransomware attack violates availability by encrypting files until a ransom is paid. Cross-site scripting violates integrity and can violate confidentiality by stealing session tokens. Understanding the CIA triad helps engineers prioritise security investments and communicate risk to stakeholders. When evaluating a new feature, ask which CIA properties it touches and what controls are needed. A login form, for example, must protect confidentiality (encrypted transport), integrity (tamper-proof session tokens), and availability (rate-limiting to prevent brute-force lockouts).

Example

<?php
// Demonstrating CIA triad concepts in code

// --- CONFIDENTIALITY: encrypt sensitive data at rest ---
$plaintext = 'user credit card: 4111-1111-1111-1111';
$key       = random_bytes(32);   // 256-bit key
$iv        = random_bytes(16);   // 128-bit IV for AES-CBC

$ciphertext = openssl_encrypt($plaintext, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv);
$encoded    = base64_encode($iv . $ciphertext); // store IV with ciphertext
echo "Encrypted: $encoded\n";

// --- INTEGRITY: hash-based message authentication code (HMAC) ---
$message   = json_encode(['user_id' => 42, 'action' => 'transfer', 'amount' => 500]);
$secretKey = bin2hex(random_bytes(32));
$hmac      = hash_hmac('sha256', $message, $secretKey);

// Verify on receipt
$incoming = $message;
$expected = hash_hmac('sha256', $incoming, $secretKey);
if (hash_equals($expected, $hmac)) {
    echo "Integrity check passed\n";
} else {
    echo "WARNING: message tampered\n";
}

// --- AVAILABILITY: rate-limit login attempts ---
function checkRateLimit(string $ip, int $maxAttempts = 5, int $windowSeconds = 300): bool
{
    // Pseudo-code using a cache/Redis counter
    $key     = "login_attempts:$ip";
    $current = cache()->increment($key);
    if ($current === 1) {
        cache()->expire($key, $windowSeconds);
    }
    return $current <= $maxAttempts;
}

HTML

Full Editor

Related Resources

Web Security Reference

Complete tag & property list

Web Security How-To Guides

Step-by-step practical guides

Web Security Exercises

Practice what you've learned