CIA Triad

Lesson plan

Level

Beginner

Time

About 70 minutes; the steps below add up to 70

Learners find the three objectives themselves, from what could go wrong with their own exam results, before the names are given. The booking-service cases then test each objective against a familiar control that does not protect it (encryption, validation, a backup), and the classification step builds the habit the rest of the course relies on: ask all three questions, separately, and record only what the evidence shows.

Objectives

• Explain the three things that must be protected about information: that only the right people can see it, that it can be trusted, and that it can be used when needed
• Name and define confidentiality, integrity and availability, the CIA triad
• Say which objective an incident affects, using three test questions, including incidents that affect more than one
• Explain what a familiar control such as encryption, validation or a backup does and does not protect
• Explain why non-repudiation is a related property but not part of the triad

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Have somewhere to write three column headings, left blank at first: they become confidentiality, integrity and availability once the class has grouped its answers.
• Decide whether the “Apply it” questions are done in class or set for another day; they count towards a learner’s mastery only on a later day.
• The lesson takes about 70 minutes. To teach it in two parts, stop after “Controls to consider”; the second part opens with “Classifying an impact”, which reuses the sports-centre cases.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Explain the three things that must be protected about information: that only the right people can see it, that it can be trusted, and that it can be used when needed
   • Name and define confidentiality, integrity and availability, the CIA triad
   • Say which objective an incident affects, using three test questions, including incidents that affect more than one
   • Explain what a familiar control such as encryption, validation or a backup does and does not protect
   • Explain why non-repudiation is a related property but not part of the triad

   Purpose: Learners find the three objectives themselves, from what could go wrong with their own exam results, before the names are given. The booking-service cases then test each objective against a familiar control that does not protect it (encryption, validation, a backup), and the classification step builds the habit the rest of the course relies on: ask all three questions, separately, and record only what the evidence shows.

2. 1. What could go wrong with your exam results? Think 6 min

   Purpose: Start from something every learner cares about, and let the class discover that there are three different kinds of problem before any term is used.

   Ask

   • Write down as many things as you can that could go wrong with the record of your exam results.
   • Can we sort these into groups? What does each group have in common?

   Responses to expect

   • Answers such as “someone hacks it”, “a teacher types it wrong”, “the website crashes on results day”. Sort them into the three unlabelled columns.
   • “Hacking” is a cause, not an outcome: ask what the hacker would do to the results, and place the answer by its effect.
   • On screen in turns: the scenario and the question, its answer (the three groups), then why it matters to say what went wrong.

   Misconceptions to challenge

   • A learner may believe: “Security just means keeping things secret.” Respond: Point at the other two columns: a wrong grade or a system that will not load harms you even if nobody else sees anything.

   Discussion pause: Let the class name the columns in their own words before revealing anything.

   In the lesson window

   • Think it through: List the things that could go wrong with the record of your exam results. Try to find three quite different kinds of problem.

3. 2. One record, three questions Predict 5 min

   Purpose: Show that the three wants are independent: one can fail while the others hold.

   Ask

   • Is a private record with the wrong dose in it well protected?
   • Can you think of a record that is correct and private but useless?

   Responses to expect

   • Most will see that privacy does not make the record safe. Ask for the harm: a patient given the wrong dose.
   • On screen in turns: the patient-record question, its answer, the three questions asked of a medical record (the objective names come in the next step), then why each can fail on its own.

   Misconceptions to challenge

   • A learner may believe: “If nobody unauthorised can get in, the information is secure.” Respond: That answers only the first question. Ask the other two separately.

   Discussion pause: Before the table appears, ask the class to put the three questions in their own words.

   If the explanation does not land: If the medical record does not land, return to the exam results: a private record with the wrong grade in it is still a failure.

   In the lesson window

   • Think it through: No stranger can read a hospital’s patient records. But a nurse has typed the wrong medication dose into one of them. Is that record well protected?

4. 3. The idea Explain 8 min

   Purpose: Name the three columns the class has already built, and give the formal definitions.

   Ask

   • Which of our three columns is which?
   • In the shop question, which two objectives still hold?

   Responses to expect

   • Learners match the columns to the names quickly. Insist on the word “authorised” in each definition.
   • Diagram: ask the class what failure looks like for each objective before revealing it. The three failures are the three groups from the opening question.
   • On screen in turns: the naming sentence, the three definitions one at a time, the exam-results diagram with its failures held back, then the failures, why CIA is not an attack sequence, and the shop question with its answer.

   Misconceptions to challenge

   • A learner may believe: “CIA is a sequence an attacker goes through.” Respond: It is a set of objectives. An incident can affect one, two or all three, in no particular order.

   If the explanation does not land: Use the three questions as the definitions: who may see it, can it be trusted, can it be used when needed. The exam-results diagram puts each beside what its failure looks like.

   In the lesson window

   • Check your understanding: A shop’s website shows the right prices and keeps customers’ details private, but it stops working every evening when most people want to buy. Which objective is failing?

5. 4. Putting it into context Experiment 16 min

   Purpose: Apply each objective to a concrete case, and show that a familiar control protects only what it was designed for.

   Ask

   • Before we read on: which objective failed in Priya’s case? Would encryption have helped?
   • Would the date-checking rule have stopped the party being moved?
   • Would restoring last night’s backup bring the booking service back?

   Responses to expect

   • Many will say encryption helps: this is the key misconception of the lesson. Ask who was at each end of the encrypted connection.
   • Some will say the backup helps; ask what was lost.
   • On screen in turns: the sports centre, then for each of the three cases: the situation and its question, the answer, which objective failed and what would have helped, then what the familiar control could not do.

   Misconceptions to challenge

   • A learner may believe: “Encryption protects confidentiality whatever happens.” Respond: Encryption protects data in transit or storage. It delivered the wrong record, safely, to the wrong person.
   • A learner may believe: “Integrity means nothing may ever change.” Respond: Authorised corrections keep a record accurate. Integrity is about unauthorised or improper change, accidents included.

   Discussion pause: After each case, ask the class for one control that would have helped before reading the lesson’s list.

   If the explanation does not land: If time is short, take the confidentiality case in full and ask the class to predict the other two from the “What happens” paragraphs only.

   In the lesson window

   • Think it through: The connection between Priya and the booking service was encrypted the whole time. Did the encryption protect the other customer’s details?
   • Think it through: The booking form refuses impossible dates, such as 31 February. Would that rule have stopped the change to Sunday the 15th?
   • Think it through: The sports centre backs up its booking records every night. Would restoring last night’s backup bring the service back?

6. 5. Controls to consider Explain 6 min

   Purpose: Consolidate controls and their limits, and model a careful incident analysis with the misdirected email.

   Ask

   • Which objectives does the misdirected email affect, and which does it not?
   • Why would restoring a backup not help?

   Responses to expect

   • Confidentiality affected; integrity not established; availability not affected. Praise “not established” over “not affected” where the evidence is silent.
   • On screen in turns: the table of controls and limits, what the limits mean, the misdirected-email facts on their own, the verdict for each objective, the response and wider obligations, then why naming the objective helps.

   Misconceptions to challenge

   • A learner may believe: “Restoring from a backup fixes any incident.” Respond: Ask what restoring would undo in the misdirected email: nothing was lost, so nothing is restored, and the disclosure stands.

   Discussion pause: Before the verdicts appear, have the class say affected, not affected or not established for each objective.

7. 6. Classifying an impact Check 10 min

   Purpose: Practise the three test questions, including the pairs most often confused, and classifying by effect rather than cause.

   Ask

   • For the attendance question: does using someone else’s password decide the objective?
   • For the results database: what evidence would make this an integrity failure as well?

   Responses to expect

   • The password question splits the room. Bring it back to the rule: classify by what happened to the information.
   • Let the class classify all six events before the objective and clue columns appear.
   • On screen in turns: the three test questions, the six events with their answers held back, then the answers, how to classify, two check questions with their answers, the three easy-to-confuse pairs one at a time, and the final check question with its answer.

   Misconceptions to challenge

   • A learner may believe: “If someone read it, it can no longer be trusted, so integrity has failed.” Respond: Reading is not changing. Check for changes, but record integrity as affected only on evidence.
   • A learner may believe: “Whoever caused it decides the objective.” Respond: An accident and an attack that do the same thing affect the same objective.

   Discussion pause: Let pairs agree on an answer before anyone reveals it.

   In the lesson window

   • Check your understanding: A school emails one pupil’s report to another pupil’s parents by mistake. Nothing in the school’s records changes, and the system keeps working. Which objective is affected?
   • Check your understanding: A pupil signs in with a friend’s password and changes their own attendance record from absent to present. The record stays private, and the system works normally. Which objective is most directly affected?
   • Check your understanding: An attacker gets into the school’s results database and reads it, but there is no sign that anything was changed. A teacher says: “We can’t trust any of the results now, so this is an integrity failure.” What is the best response?

8. 7. One incident can affect several objectives Discover 4 min

   Purpose: Show that one incident can affect several objectives, each established by its own evidence.

   Ask

   • If records are stolen, what else would you need to find out?

   Responses to expect

   • Whether anything was changed, and whether the service still works.
   • On screen in turns: the stolen-records question, its answer, incidents with more than one consequence, then what CIA does not tell you.

   If the explanation does not land: Ask: if records are photocopied, are the originals changed? Theft and alteration each need their own evidence.

   In the lesson window

   • Think it through: In an incident, customer records are stolen. Does that tell you whether the records were also altered?

9. 8. Beyond the triad Explain 3 min

   Purpose: Separate non-repudiation from the triad, a common examination trap.

   Ask

   • How many members does the triad have? Where does non-repudiation fit?

   Responses to expect

   • Some will call non-repudiation a fourth member; correct this firmly.
   • On screen in turns: the definition of non-repudiation, the payment-approval question and its answer, then where the property is taught.

   Misconceptions to challenge

   • A learner may believe: “Non-repudiation is part of integrity.” Respond: It relies on integrity, because the evidence must not change, but its purpose is different: an action cannot credibly be denied.

   In the lesson window

   • Check your understanding: A finance system keeps a protected record of who approved each payment, so that nobody can later deny having approved one. Which property is that?

10. 9. Apply it in a new situation Apply 4 min

    Purpose: Set up independent application in new settings, ideally on a later day.

    Ask

    • Who will try these now, and who will come back to them later in the week?

    Responses to expect

    • The surgery question tests effect over cause; the encryption question tests control limits.
    • On screen in turns: the surgery question and its answer, then the encryption question and its answer.

    In the lesson window

    • Apply it: After a software update, every appointment in a doctors’ surgery’s online booking system shows one hour later than it was booked. The system stays online, and nobody outside the surgery can see the appointments. Which objective is affected?
    • Apply it: A manager says: “We have encrypted our whole customer database, so all three CIA objectives are now protected.” What is the best response?

11. 10. Check your understanding Check 6 min

    Purpose: Check recall and classification with the approved revision-bank questions.

    Ask

    • Answer two or three individually, then compare with a neighbour.

    Responses to expect

    • The fourth and tenth questions have more than one correct statement and are marked right only when exactly those are chosen; read their options aloud.
    • On screen in turns: each of the ten revision questions, each followed by its answer, then where to practise. The questions are interactive: learners choose and check before the explanation opens.

    Discussion pause: Reveal answers only after most of the room has committed.

12. 11. What to remember Consolidate 2 min

    Purpose: Summarise the three objectives, the habit of asking all three questions, and the limits of controls.

    Ask

    • Without looking: the three questions, in your own words.

    Responses to expect

    • Who may see it? Can it be trusted? Can it be used when needed?
    • On screen in turns: the summary, then the common misunderstandings.

13. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Confidentiality, integrity and availability are three separate objectives; each can fail while the others hold.
    • Classify an incident by what happened to the information or system, not by who caused it or how.
    • Record only what the evidence shows for each objective.
    • Every control has limits: encryption, validation and backups each protect something specific.
    • Non-repudiation is related to the triad, but it is not part of it.

Consolidation

• Confidentiality, integrity and availability are three separate objectives; each can fail while the others hold.
• Classify an incident by what happened to the information or system, not by who caused it or how.
• Record only what the evidence shows for each objective.
• Every control has limits: encryption, validation and backups each protect something specific.
• Non-repudiation is related to the triad, but it is not part of it.