1.2 Confidentiality, Integrity, and Availability
Confidentiality: Control Who May Read
Confidentiality is enforced with keys and permissions, not secrecy of algorithm. At rest, full-disk encryption does the work — BitLocker uses XTS-AES-128/256, FileVault uses AES-XTS-256. In transit, TLS 1.3 (RFC 8446) negotiates suites such as TLS_AES_256_GCM_SHA384 with forward secrecy baked in. Layered on top are RBAC and least privilege: a support ticketing account should not be able to query the payroll table. In practice implementations fail at key management, not ciphers; openssl enc -aes-256-cbc -k password123 is decoration, because a weak passphrase makes the strongest block cipher irrelevant.
Integrity: Control Who May Change
Integrity means every change is attributable and detectable. Unkeyed digests use SHA-256 (FIPS 180-4) — verify a download with sha256sum -c SHA256SUMS. Where the sender must also be proven, use HMAC-SHA256 for a keyed check or an ECDSA P-256 signature. Platform integrity extends downward: measured boot hashes each stage into TPM PCRs, so PCR7 changes the moment boot configuration changes, and code signing (Authenticode, notarization) lets the OS refuse unsigned binaries. Encryption alone does not protect integrity — some modes malleably allow ciphertext edits.
Availability: Control Whether It Answers
Availability is a budget, so write it down: 99.99% availability permits only 52.6 minutes of downtime per year. Recovery objectives follow — RPO caps lost data, RTO caps outage time — which is why the 3-2-1 backup rule (three copies, two media, one offline and immutable) is paired with scheduled restore tests. Redundancy handles the mundane: RAID-1 or RAID-5 for disk failure, multi-availability-zone placement for services. Availability must also be defended actively: DNS ANY queries have been used as reflectors with roughly 54x amplification, and Response Rate Limiting (RFC 9014) plus source validation blunt that class of DDoS.
The Pillars Pull Against Each Other
Strict integrity lowers availability: a pinned package mirror that rejects signature mismatches can block an emergency deploy. Strict availability lowers confidentiality: break-glass admin accounts that bypass approval to restore service are exactly the accounts attackers hunt after ransomware. Controls are therefore trade-off decisions, categorized against FIPS 199 impact levels and prioritized with the CIS Critical Security Controls, not free wins.
Architecture Diagram
Key Takeaways
- Confidentiality comes from keys and access rules: FDE, TLS 1.3 suites, RBAC, least privilege.
- Integrity must be verifiable change: SHA-256 digests, HMAC, ECDSA signatures, measured boot.
- Availability is a numeric budget: 99.99% allows about 52.6 minutes of downtime per year.
- The pillars conflict; every control is a documented trade-off, never a free win.
- Prove integrity and availability by restoring and verifying, not by trusting configuration.