Overview
The CIA triad gives you three core security objectives, but real systems often need more than three words to describe what "secure" means. This lesson connects the triad to the wider set of objectives security teams actually plan around, including two that are frequently added: authenticity and non-repudiation.
Learning objectives
- Restate the CIA triad as a set of objectives.
- Explain authenticity and non-repudiation.
- Understand how objectives translate into requirements and controls.
Core concept
A security objective is a goal you want the system to satisfy. The three foundational ones are Confidentiality, Integrity, and Availability. Two objectives are so commonly needed that many frameworks list them alongside the triad:
- Authenticity — being able to verify that data or a message genuinely comes from the claimed source (closely tied to integrity).
- Non-repudiation — ensuring someone cannot credibly deny having performed an action, e.g. through signed, logged transactions.
NIST's foundational definitions (FIPS 199) formally define confidentiality, integrity, and availability as the security objectives for information systems; authenticity and non-repudiation extend them for scenarios like digital signatures and audit trails.
How it works
Objectives drive requirements, which drive controls:
- State the objective: "Only the account owner may view their statements" (confidentiality).
- Derive requirements: authentication, per-user authorization, encryption in transit.
- Choose controls: password + MFA, role checks, TLS.
This chain keeps security grounded in why a control exists, rather than adding tools for their own sake.
Practical example
For an e-signature service, the objectives are: integrity (the document is unaltered), authenticity (it was signed by the named person), and non-repudiation (the signer cannot later deny it). All three are met with digital signatures plus tamper-evident audit logs — a concrete mapping from objectives to a single mechanism.
Cybersecurity relevance
Framing work as objectives is how professionals avoid "checklist security." When you can name the objective a control serves, you can judge whether it is worth its cost and whether a gap exists.
Common mistakes
- Adding controls without a stated objective, producing complexity with no clear benefit.
- Forgetting authenticity/non-repudiation in systems (payments, legal, logging) where "who did this, provably?" matters.
Key takeaways
- Security objectives are the goals controls exist to satisfy; CIA is the foundation.
- Authenticity and non-repudiation are commonly added for signatures and audit trails.
- Good security traces every control back to an explicit objective.
Check your understanding
- For an online banking transfer, name one control that primarily serves each of confidentiality, integrity, and non-repudiation.
- Why is "authenticity" closely related to integrity?