Describe how the confidentiality, integrity and availability (CIA) triad is applied to the design of secure software

The CIA triad gives three security goals every secure system must address.

Confidentiality means only authorised users can read sensitive data. In an online banking app, account balances are encrypted in transit using HTTPS and encrypted at rest in the database. A logged-in user can see their own balance but not other customers' balances.

Integrity means data is not altered by unauthorised parties or by accident. The app records every transaction in an append-only ledger and uses cryptographic hashes to detect tampering. If a hacker tries to modify a transaction amount, the hash mismatch flags it immediately.

Availability means authorised users can access the system when they need it. The bank runs the app across multiple data centres with automatic failover so a power outage in one region does not bring down the service. Rate limiting prevents denial-of-service attacks from exhausting capacity.

Markers reward all three principles named correctly, one concrete banking-context example each, and at least one mechanism (encryption, hashing, redundancy) per principle.

The breach is of confidentiality only.

Confidentiality requires that sensitive data is accessible only to authorised users. Unauthorised viewing of patient records is a direct confidentiality breach, even though no data was altered or deleted.

Integrity has not been breached because the data has not been changed. Availability has not been breached because the system stayed online.

Markers reward correct identification of confidentiality, an explicit statement that integrity and availability were not breached, and reference to the criterion (unauthorised viewing of data).

Confidentiality: only authorised users can read sensitive data; an attacker breaching it READS data they should not see.

Integrity: data is not altered by unauthorised parties or accident; an attacker breaching it CHANGES data without authorisation.

Availability: authorised users can access the system when needed; an attacker breaching it BLOCKS or denies access.

Marking criteria: 1 mark per correctly defined principle with its matching attacker action, up to 3 marks.

(i) A stranger reading an exposed backup is a confidentiality breach: unauthorised viewing of data, nothing was changed or made unavailable.

(ii) A customer altering product prices via a bug is an integrity breach: data (the price) was changed without authorisation.

(iii) The site becoming unreachable under load is an availability breach: authorised customers cannot access the system when they need it.

Marking criteria: 1 mark per correctly classified incident (3 marks total), 1 mark for briefly justifying at least one classification with the correct definition.

Confidentiality

Encrypt payment details at rest with column-level database encryption and require the user to re-authenticate before viewing billing history; this matches the high sensitivity of payment data, which is a common target for theft.

Integrity

Validate heart-rate and step-count values against physiologically plausible ranges (e.g. reject a heart rate of 400 bpm) before storing them, and hash daily summaries so tampering with historical fitness data is detectable; this matters because corrupted health data could mislead a user's training decisions.

Availability

Run the sync service across at least two regions with automatic failover, since users expect their tracker to sync data immediately after a workout, and an outage during peak morning exercise hours would frustrate a large share of the user base at once.

Marking criteria: 1 mark for a specific (not generic) control per principle (3 marks total), 2 marks distributed for justifications that correctly link each control's strength to the actual sensitivity or usage pattern of that data type.

Ransomware first encrypts a victim's files with a key only the attacker holds, which directly breaches availability: authorised users can no longer open or use their own files.

Many modern ransomware operations also copy sensitive files to an attacker-controlled server before encrypting them ("double extortion"), threatening to publish the stolen data if the ransom is not paid. This second step breaches confidentiality, because unauthorised parties have read data they should never have accessed.

For example, if a law firm's case files are encrypted and copied off-site, the firm loses access to its own files (availability) while client-privileged documents are simultaneously exposed to the attacker (confidentiality), showing a single incident can breach two principles at once.

Marking criteria: 1 mark for identifying the availability breach with correct reasoning, 1 mark for identifying the confidentiality breach (data exfiltration) with correct reasoning, 2 marks for a coherent worked scenario that ties both breaches to the same incident.

Authenticity confirms that a message or party is genuine, for example verifying that a funds-transfer instruction really came from the account holder's registered device, using a digital signature or certificate.

Non-repudiation ensures the account holder cannot later deny having authorised the transfer, typically by keeping a signed, tamper-evident audit log of the instruction and its authorisation.

A bank needs authenticity to stop a fraudster from impersonating the account holder in the first place, and non-repudiation so that if the genuine account holder later disputes a legitimate transfer, the bank can produce cryptographic proof the instruction was authorised by them, protecting the bank from false disputes and the customer from being blamed for a transfer they did not make.

Marking criteria: 1 mark for a correct definition of authenticity, 1 mark for a correct definition of non-repudiation, 2 marks for explaining why a bank specifically needs both in a funds-transfer context.

This is an extended-response evaluate question: markers reward identifying weaknesses against the correct principle AND a justified priority order, not just a list of fixes.

Confidentiality weakness and fix

A shared staff password means any staff member (or anyone who learns the shared password) can read every patient's record with no accountability; replace it with individual accounts and role-based access so nurses see only their ward's patients and administrators cannot view clinical notes, directly reducing unauthorised reading of sensitive data.

Integrity weakness and fix

Unencrypted storage on a single server has no mechanism to detect tampering; add an append-only audit log with per-change hashes, so any unauthorised edit to a diagnosis or medication record is detectable and traceable to a specific account.

Availability weakness and fix

A single on-premises server with no backup means a hardware failure, fire or ransomware attack could destroy all patient records permanently; implement automated, encrypted off-site backups on a daily schedule, with periodic restore testing.

Priority

The confidentiality fix (individual accounts and RBAC) should be implemented first, because the shared password is actively exploitable right now by any current or former staff member with no detection possible, whereas the integrity and availability gaps, while serious, require a specific triggering event (an edit or a disaster) before harm occurs; removing the shared credential closes the widest and most immediate exposure.

Marking criteria: 1 mark per correctly diagnosed weakness matched to the right principle (3 marks), 1 mark per justified fix (3 marks), 1 mark for a reasoned priority order that compares likelihood/impact rather than asserting an order without justification.

A strong assess response takes a clear position, supported by the definition and a named attack, and briefly reconciles the counter-view.

Position

The claim is false. NESA's CIA triad explicitly places availability alongside confidentiality and integrity as one of the three core goals of secure software design, because a deliberate attacker, not just a hardware fault, can just as easily deny access as they can steal or alter data.

Evidence

A distributed denial-of-service (DDoS) attack deliberately floods a server with traffic from many compromised machines specifically to exhaust its capacity and make it unreachable for legitimate users; this is unambiguously a security incident, carried out by an adversary with intent, not a random hardware failure. Ransomware is a second example: it deliberately encrypts files to deny access until a ransom is paid, again a hostile act, not an accident.

Reconciling reliability

It is true that ordinary reliability engineering (redundant servers, backups, monitoring) protects availability against both accidental failures AND deliberate attacks, which is why the two concerns share tooling; this overlap likely motivates the claim. However, the fact that the SAME defence also stops a hostile actor does not make availability any less a security property, since the triad is defined by what is being protected (uninterrupted access) and against whom (including deliberate attackers), not by which team implements the fix.

Judgement

Availability is a genuine security concern because it has real adversaries with intent (DDoS operators, ransomware groups) who deliberately target it, even though the same controls also happen to improve ordinary reliability.

Marking criteria: 2 marks for a clear position with reasoning, 2 marks for at least one correctly explained named attack type demonstrating deliberate targeting of availability, 1 mark for engaging with the reliability counter-view, 1 mark for an explicit final judgement.