Overview
In theory you want maximum confidentiality, integrity, and availability all at once. In practice these goals pull against each other, and against usability and cost. Real security work is largely about making sensible trade-offs. This lesson shows how the CIA triad behaves under real constraints.
Learning objectives
- Explain why CIA goals conflict.
- Reason about trade-offs using concrete scenarios.
- Connect trade-offs back to risk and business priorities.
Core concept
Strengthening one property often weakens another:
- Confidentiality vs. Availability: encrypting everything and locking down access protects secrets, but a lost key or an over-strict rule can lock out legitimate users.
- Integrity vs. Availability: rejecting any slightly suspicious transaction protects integrity but can block valid work.
- Security vs. Usability: every extra check (more MFA prompts, shorter session timeouts) adds friction; too much friction pushes users toward insecure workarounds.
There is no universally "correct" balance — it depends on what the organization is protecting and what it can tolerate losing.
How it works
Teams resolve trade-offs by ranking the objectives for a given asset, guided by risk:
- Identify the asset and which CIA property matters most.
- Estimate the impact of losing each property.
- Invest most in the property whose loss hurts most, accepting proportionate weakness elsewhere.
Practical example
Compare two systems:
- A stock-trading platform prioritizes availability and integrity — being down or showing wrong prices for seconds costs enormously, so it accepts complexity and cost to stay up and correct.
- A classified document store prioritizes confidentiality — it may accept being slower or occasionally unavailable rather than risk a leak, e.g. by keeping systems offline ("air-gapped").
Same triad, opposite emphasis, because the assets and threats differ.
Cybersecurity relevance
Every design decision later in this curriculum — how strict a firewall rule is, how aggressive an intrusion-prevention system is, how long a session lasts — is a CIA trade-off. Recognizing them keeps you from optimizing one property while quietly breaking another.
Common mistakes
- Maximizing one property in isolation (e.g. security so tight the system is unusable, so people bypass it).
- Pretending trade-offs don't exist and promising "totally secure and totally convenient."
- Ignoring the business context that should decide the balance.
Key takeaways
- Confidentiality, integrity, and availability frequently conflict, and all trade off against usability and cost.
- The right balance depends on the asset, its threats, and the organization's risk tolerance.
- Good security makes trade-offs deliberately and explicitly, not by accident.
Check your understanding
- For a hospital's life-support monitoring system, which CIA property likely ranks highest, and why?
- Give an example where increasing confidentiality directly reduced availability.