Overview
Availability is the third pillar of the CIA triad. It means that systems, services, and data are accessible to authorized users when they need them. A perfectly confidential and accurate system is useless if legitimate users cannot reach it.
Learning objectives
- Define availability and why it is a security concern, not just an operations concern.
- Identify threats to availability.
- Describe controls that keep systems available.
Core concept
Availability is about uptime and access for the right people. It is threatened by deliberate attacks, accidents, and failures alike:
- Deliberate: Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) attacks flood a system so it cannot serve real users; ransomware makes data unavailable by encrypting it.
- Accidental / environmental: hardware failure, power loss, misconfiguration, software bugs, or a fibre cut.
Because attackers can target availability, it is squarely a security property — not merely an IT reliability metric.
How it works
Availability is protected through redundancy and resilience — never depending on a single component:
- Redundancy: multiple servers, disks (RAID), power supplies, and network links so one failure does not stop the service.
- Backups and disaster recovery: tested restores that bring data back after loss or ransomware.
- Load balancing and rate limiting: spread traffic across servers and blunt floods.
- DDoS mitigation and monitoring: detect abnormal traffic and absorb or filter it.
Practical example
An online store runs its website on several servers behind a load balancer, keeps hourly database backups in a separate location, and uses a DDoS-mitigation service. If one server crashes, the others carry the load. If a flood arrives, the mitigation service filters it. If data is corrupted, backups restore it. Each control targets a different availability threat.
Cybersecurity relevance
Ransomware — one of the most damaging modern threats — is primarily an availability attack (and often a confidentiality one too, when data is also stolen). Understanding availability explains why backups and incident-response planning appear throughout the defensive paths.
Common mistakes
- Treating availability as "just an ops problem." Attackers deliberately destroy availability.
- Having backups but never testing restores. An untested backup is a hope, not a control.
- Single points of failure hidden in an otherwise redundant design (e.g. one shared database).
Key takeaways
- Availability means authorized users can access systems and data when needed.
- It is threatened by attacks (DoS, ransomware) and by failures alike.
- Redundancy, tested backups, and load management keep services available.
Check your understanding
- Why is ransomware considered primarily an availability attack?
- Explain why "we have backups" is not enough on its own to guarantee availability.