Lesson 2 — Beginner

CIA Triad (Confidentiality, Integrity, Availability)

CIA triad cybersecurity ka dil hai — har policy, har tool, har exam question isi par ghoomta hai. Is lesson mein teeno pillars detail mein samjhenge, unke beech ka trade-off, aur real systems mein ye kaise apply hote hain.

⏱ 13 min• Beginner• Introduction

CIA triad kya hai

WHAT

CIA triad teen security goals ka group hai — Confidentiality (sirf sahi log dekhein), Integrity (data badla na ho), Availability (jab chahiye tab mile). In teeno ka balance hi secure system hai.

WHEN

Har security decision mein — password policy (confidentiality), file checksum (integrity), backup (availability). Interview ka sabse pehla sawaal yahi hota hai.

WHERE

Banking, healthcare, defence, school portal — har organization mein teeno alag tarah enforce hote hain.

Simple yaad rakho: Confidentiality = chori rokna, Integrity = ched-chad rokna, Availability = service chalti rahe. Teenon mein se koi bhi tootega toh system insecure hai.

Teeno pillars detail mein

CONFIDENTIALITY
  Goal : data sirf authorized log padh sakein
  Tools: encryption, access control, MFA
  Fail : data leak, exposed cloud bucket

INTEGRITY
  Goal : data accurate + unchanged rahe
  Tools: hashing, digital signature, version control, audit logs
  Fail : records badal diye gaye, corrupted file

AVAILABILITY
  Goal : service jab chahiye tab up ho
  Tools: backup, redundancy, DDoS protection, UPS
  Fail : server down, ransomware ne files lock ki

Interview gold: Q: "Ek example do teeno ka." A: Encrypted message = confidentiality, bank balance ka hash verify = integrity, backup + firewall = availability. Har pillar ka ek example ready rakho.

Trade-off — teeno ka balance

Security mein teeno hamesha ek doosre se thode ladte hain. Zyada confidentiality = kaam karne mein dikkat, zyada availability = risk badhta hai:

Availability vs Confidentiality: bahut strict lockdown kar diya toh employees kaam nahi kar payenge (service ruk jaayegi).
Availability vs Integrity: system ko hamesha up rakhne ke liye offline copy rakhi — par purani copy galat bhi ho sakti hai.
Confidentiality vs Usability: 30-char password + 5 factor MFA safe hai par har login pe time jaata hai.
Solution: risk ke hisaab se balance karo — hospital mein availability zyada, defence mein confidentiality zyada.

Yaad rakho: 100% security naam ki cheez nahi hoti. Goal hai reasonable protection + business chalta rahe — isi balance ko risk management kehte hain.

CIA ke saath 4 aur principles aate hain — exam mein "CIA ke alava kya?" poochha jaata hai:

Authentication (AuthN)  : identity verify — tum sach mein tum ho?
Authorization  (AuthZ)  : permission check — kya tumhe ye allowed hai?
Non-repudiation         : baad mein mana nahi kar sakte
                         (digital signature = proof ki maine hi kiya)
Accountability          : har action ka audit trail (kisne kiya)
Privacy                 : personal data ka control user ke paas

Trick: CIA = goal, ye sab = CIA ko poora karne wale tools

Dhyan do: Authentication "kaun" hai, Authorization "kya chalega". Ye farak har interview mein ghoom ke aata hai — agla module isi par focus karega.

Exercise

Question: CIA triad ke teeno components comma se likho.

Question: Data ke badalne se bachana kis principle se related hai? (confidentiality/integrity/availability)

Question: Encryption ka sabse seedha goal kya hai? (confidentiality/integrity/availability)

Common mistakes

CIA aur AAA ko confuse karna: CIA = security goals (confidentiality, integrity, availability). AAA = authentication, authorization, accounting. Dono alag list hain.
Integrity ka matlab "secret hona" samajhna: Secret rakhna = confidentiality. Integrity ka matlab hai data accurate hai aur kisi ne ched-chad nahi ki.
Availability ko ignore karna: Data safe hai par server hi down ho toh kaam nahi chalega. DoS/ransomware directly availability attack hain.

Desi example: Bank account teeno ke saath

Tumhara bank account CIA ka perfect example hai — PIN se confidentiality, ledger/integrity check se accuracy, aur ATM/online 24x7 chalna availability:

Confidentiality : PIN + OTP (sirf tum dekh sakte ho)
Integrity       : balance statement match hona chahiye
Availability    : ATM chalu, app 24x7 kaam kare
Fail example    : statement mein entry badal di = integrity breach

Exam mapping (CUET / TCS / Security+)

CUET/TCS: "Which is NOT part of CIA triad?" — speed, cost wo nahi hain.
Security+ Domain 1 ka backbone yahi hai.
Interview: har pillar ka 1 example maanga jaata hai.
Trap: "Encryption ensures integrity" — galat, encryption confidentiality deta hai (integrity ke liye hashing/signature).

Lesson complete?

CIA triad clear! Agla lesson — Cyber Threats — mein dekhenge ye goals todne kaun kaunse attacks aate hain.