Security+ — Part 1: CIA Triad, AAA & Authentication Models
Welcome Back!
If you’ve spent any time studying cybersecurity, you’ve heard the CIA Triad mentioned. It’s one of those concepts that shows up everywhere — in job interviews, in compliance frameworks like SOC 2 and NIST CSF, and in the design of almost every security control you’ll ever work with. Understanding it at a foundational level changes how you think about every security decision.
This is Part 1 of the Security+ series. Full notes on GitHub.
The CIA Triad
The CIA Triad is the core model for information security. Every control, policy, and framework in this field maps back to protecting at least one of these three properties.
| Element | Meaning | Examples |
|---|---|---|
| Confidentiality | Ensure data is accessible only to authorized users | Encryption, access controls |
| Integrity | Ensure data is accurate and untampered | Hashing, checksums, digital signatures |
| Availability | Ensure systems and data are accessible when needed | Redundancy, backups, fault tolerance |
A breach that exposes data violates Confidentiality. A ransomware attack violates Availability. A man-in-the-middle attack that alters data in transit violates Integrity. Real attacks usually hit more than one.
The AAA Framework
AAA defines how users are verified and held accountable in a system. It works in sequence — you authenticate first, then authorization determines what you can do, and accounting tracks what you did.
| Component | Function | Examples |
|---|---|---|
| Authentication | Verify identity | Passwords, biometrics, MFA |
| Authorization | Determine what actions an authenticated user can take | RBAC, ACLs, group policies |
| Accounting | Track user actions and access | Logs, audits, session tracking |
Authentication Factors
Authentication factors are grouped by what proves your identity:
- Something you know — Password, PIN
- Something you have — Token, smart card
- Something you are — Biometrics (fingerprint, retina)
- Somewhere you are — Location-based (GPS, IP)
- Something you do — Behavioral patterns (typing rhythm)
Multi-factor authentication (MFA) combines two or more of these. The reason MFA is so effective is that stealing a password doesn’t give you the second factor.
Authorization Models
Once a user is authenticated, the system needs rules for what they’re allowed to do. These are the most common models:
| Model | Description | Use Case |
|---|---|---|
| DAC (Discretionary Access Control) | Owner controls permissions | File/folder sharing on a local machine |
| MAC (Mandatory Access Control) | System-enforced, based on classification | Government/military data classification |
| RBAC (Role-Based Access Control) | Based on job roles | HR, Finance, IT departments in orgs |
| ABAC (Attribute-Based Access Control) | Based on attributes (location, time, etc.) | Complex cloud or enterprise policies |
Most enterprise environments use RBAC because it scales well — you assign roles, not individual permissions. ABAC adds more granularity when you need it.
These concepts are the foundation everything else builds on. If you want to go deeper on how access control ties into compliance, the SOC 2 & NIST CSF series covers how these models show up in real audit frameworks.
Part 2 covers Zero Trust and physical security
Stay Curious!