CIA Triad Scenario Sorter

Three words carry the whole security curriculum, and this is where they get their meaning. Confidentiality is about who can see the data. Integrity is about whether the data is still what it was. Availability is about whether anyone can reach it at all. Every breach in the news lands somewhere in those three, and naming which one is the first move an analyst makes. The sorting is easier than it looks once the question is the right one. The question is not how bad the incident was, or how it happened — phishing, misconfiguration and malware turn up in all three bins. The question is what actually changed for the data. A customer database posted publicly, credentials pulled off unencrypted traffic, salary data forwarded to a personal Gmail, medical records opened by a stranger, an S3 bucket left readable: in all five the data is intact and the service is up. Somebody simply saw it who should not have. That is Confidentiality, every time. The Integrity five look superficially similar — an attacker got in — but the data is different afterwards. Wire transfer details rewritten, drug dosages altered, audit log entries edited, an order changed in transit, product prices modified. Nobody is locked out, and in most of these nothing has been stolen. The damage is that the record now lies, which is worse than losing it: a missing record is obviously missing, and a wrong one is trusted. The Availability five never touch the contents at all. A DDoS, a SYN flood, a power cut with no generator failover, a firewall rule that shuts the whole company out — the data is exactly as accurate and exactly as private as it was, and none of that helps anyone who cannot get to it. Two of those are not attacks in the first place. The outage and the firewall are a failure and a mistake, and they belong in the bin just the same, which is the point: the triad classifies impact, not intent. Ransomware is the one that will not sit still. Encrypting every file makes the data unreachable, so Availability is the primary answer and the one this activity grades. But ransomware crews routinely copy the data out before they encrypt it and threaten to publish, which is a Confidentiality breach, and files rewritten as ciphertext are no longer the records they were, which touches Integrity. All three are genuinely in play. Sorting it under Availability is not a claim that the other two are absent — it is a claim about what the victim notices first and what the attacker is actually selling back. Real incidents rarely violate exactly one property. The triad is a set of lenses, not a set of boxes.