CIA triad and privilege principles for control design
Foundations governance engagement: mapped Confidentiality, Integrity, and Availability to control objectives and privilege design so architecture decisions stay balanced under real threats.
Restated CIA pillars for leadership and tied them to privilege and protocol choices on the estate.
Documented triad answers used in the control-design workshop.
Engagement summary
Restated CIA pillars for leadership and tied them to privilege and protocol choices on the estate.
PRINCIPLES OF SECURITY reframed the CIA triad as an engineering checklist. Integrity — data cannot be altered by unauthorized parties (checksums, signing, immutable backups, change control). Availability — data and services remain usable when needed (redundancy, DDoS posture, tested restores). Confidentiality — only authorized subjects access data (encryption, IAM, network segmentation). Privilege principles extend CIA: least privilege, need-to-know, separation of duties, and defense in depth so a single control failure does not collapse all three pillars. Client briefing uses CIA to adjudicate trade-offs — e.g. aggressive availability patches vs integrity of change windows; encryption at rest for confidentiality vs key-management availability risk.
Business impact
Projects that optimize one pillar (always-on availability) without integrity/confidentiality controls create fraud and breach paths. Ransomware is an Availability and Integrity event first — backups without integrity verification fail the triad.
Pillar mapping
Documented triad answers used in the control-design workshop.
ANALYST · GOVERNANCE
savvy@lab:~$ # unauthorized alteration prevented by…
integrity
savvy@lab:~$ # usable when needed…
availability
savvy@lab:~$ # authorized access only…
confidentiality
CONTROL HINTS
cia-controls.txt
Confidentiality encryption, IAM, DLP, segmentation
Integrity signing, WORM backups, CI attestations
Availability HA, backups tested, rate limits, DR drills
Privilege least privilege, SoD, just-in-time adminRemediation
Require every major change request to state which CIA pillars it strengthens or risks. Reject “security projects” that cannot name a pillar. Pair privilege reviews with quarterly access certification.