High School Beginner • Module B1 • Lesson B1.2
Confidentiality, Integrity, and Availability
The CIA triad is one of the most important beginner security models. It helps defenders explain what kind of protection is needed: keeping information private, keeping it accurate, and keeping it usable.
Visual Model
The CIA Triad
Confidentiality
Who should be able to see it?
Integrity
Can we trust that it is accurate?
Availability
Can authorized people use it when needed?
Training rule: every example here is fake, defensive, and school-safe.
Lesson Progress
B1.2 Confidentiality, Integrity, and Availability
High School Beginner • B1: Cybersecurity Foundations • Lesson 2 of 7
Readiness Check
Before You Start
0/3 ready
Real-World Professional Hook
A defender needs a clear security goal.
Imagine a fictional school system called Falcon Portal. If a student's fake grade is shown to the wrong person, that is a confidentiality problem. If the fake grade is changed incorrectly, that is an integrity problem. If the portal is down when students need it, that is an availability problem.
The CIA triad gives defenders a simple professional language for describing what went wrong and what kind of protection matters most.
Learning Objective 1
Define confidentiality, integrity, and availability using safe school examples.
Learning Objective 2
Classify fake incidents by which CIA goal is most directly affected.
Learning Objective 3
Choose beginner defensive controls that support each CIA goal.
Why This Matters
Different problems need different defenses.
Private but unavailable?
The data might still be confidential, but users cannot use it. That points to availability.
Available but incorrect?
The system might load, but the information cannot be trusted. That points to integrity.
Accurate but exposed?
The information may be correct, but the wrong audience can see it. That points to confidentiality.
Core Concept
The CIA triad explains what defenders are trying to protect.
Confidentiality
Who should be able to see it?
Protect information from being viewed by people who are not supposed to access it.
Fake example: A student's fake grade report should only be visible to approved users.
Integrity
Can we trust that it is accurate?
Protect information and systems from being changed in the wrong way.
Fake example: A fake assignment score should not change unless an approved teacher updates it.
Availability
Can authorized people use it when needed?
Protect access to systems, services, and data so they work when authorized users need them.
Fake example: A fake learning portal should be reachable when students need to submit work.
Visual Diagram
CIA protection triangle
This built-in visual acts like an image without needing an external file. It shows how one system can need all three security goals at the same time.
C
Private
I
Accurate
A
Usable
Protected Asset
Fake Grade Portal
Confidentiality control
Use approved access rules so only the right fake users can view the right fake records.
Integrity control
Use review steps and change records so fake grades are not edited incorrectly.
Availability control
Use backups, maintenance plans, and support workflows so the fake portal can recover.
Visual Model
From Event to CIA Goal
When something happens, defenders do not panic or guess. They classify the problem, then choose the safest defensive next step.
Read the fake evidence carefully.
Decide whether privacy, accuracy, or access is most affected.
Choose a defensive response and report through the right path.
Key Vocabulary
CIA terms defenders use
Confidentiality
The security goal of keeping information visible only to authorized people.
Integrity
The security goal of keeping information accurate, complete, and trustworthy.
Availability
The security goal of keeping systems and data usable when authorized people need them.
Authorized user
A person or account that has approved permission to access a system or data.
Unauthorized access
Access by someone who does not have permission. Students should report concerns instead of investigating themselves.
Security goal
The protection outcome a defender is trying to support, such as privacy, accuracy, or uptime.
Technical Breakdown
How to classify a fake incident
Common Mistakes
What beginners often confuse
Calling every issue a privacy issue
Some issues are about accuracy or access, not only who can see data.
Ignoring overlap
One fake event can affect multiple goals, such as a file being exposed and changed.
Jumping to blame
Defenders classify evidence first and avoid accusing people without facts.
Fake Dashboard
Fake CIA Status Dashboard
A fictional security dashboard showing how a defender might summarize protection goals.
Confidentiality
Review
One fake report may be visible to the wrong test group.
Integrity
Stable
No fake records show unexpected changes.
Availability
Degraded
Portal response time is slow for a practice class.
Fake SOC Alert
Fake Grade Portal Visibility Alert
Source: Fake Access Review System • Time: 10:42 AM
Fake Log Panel
Fake CIA Event Samples
10:01 portal.report access_group=students result=allowed file=fake-grade-summary.pdf 10:08 portal.record grade_change status=approved_by_teacher value=93 10:16 portal.service status=slow users_affected=42 10:42 access_review finding='fake report visible to extra test group' cia_goal=confidentiality
Training note: this is fake data for defensive analysis practice only.
Safe Defensive Lab
Classify fake events by CIA goal
Read each fictional event. Decide which CIA goal is most directly affected. This lab is about classification, not real investigation, testing, or blame.
Fake Event 1
A practice health form is visible to a club member who should not need it.
Most direct goal: Confidentiality
Fake Event 2
A practice assignment score changes from 88 to 8 because of a typo.
Most direct goal: Integrity
Fake Event 3
A practice learning site cannot load during a review session.
Most direct goal: Availability
Fake Event 4
A fake backup restores an older version of a document by mistake.
Most direct goal: Integrity
Fake Event 5
A fictional lunch payment page is offline for scheduled maintenance.
Most direct goal: Availability
Fake Event 6
A fake club roster is emailed to a wider test list than intended.
Most direct goal: Confidentiality
Analyze the Evidence
Which CIA goal is most affected?
What is the best beginner defender conclusion?
Scenario Decision Lab
A classmate sends you a real screenshot
A classmate says they can see something in a real school system that they probably should not see. They offer to send you a screenshot so you can help classify it. What should you do?
Defender Habits
Defender Checklist
Check Your Understanding
Mini Scored Quiz
Choose your answers first. Explanations appear only after submission.
1. Which CIA goal focuses on keeping information visible only to authorized people?
2. A fake grade changes from 91 to 19 because of an input mistake. Which CIA goal is most directly affected?
3. A fake learning portal is private and accurate, but students cannot access it during class. Which goal is most affected?
4. What should a student do if a real system appears to expose private information?
Portfolio Prompt
Write a CIA Classification Brief
Create a fake school technology scenario with three short events: one confidentiality issue, one integrity issue, and one availability issue. For each event, write 2-3 sentences explaining what happened, which CIA goal is most affected, and what safe defensive response should happen next.
Key Takeaways