DAD Triad

An attacker obtaining a confidential customer document is an example of disclosure. The loss concerns who can access the information, not whether it disappears from the legitimate user’s system. An attacker can copy or read a document while the original remains present and accurate.

Disclosure need not mean public posting. Access by one unauthorised recipient can be enough to affect confidentiality. It can also result from a mistake, such as sending a file to the wrong person, rather than an attacker exploit. Establish which information was accessible and to whom; do not infer alteration or disruption solely from evidence of disclosure.

Legitimate editing is not automatically an adverse outcome: an authorised correction may restore accuracy. The concern is unauthorised or improper modification. Both deliberate misuse and accidental incorrect changes can affect integrity, whether or not confidential information was also exposed.

Changing a customer’s booking date without authorisation undermines integrity. The change might look ordinary and remain within valid date formats, yet conflict with the approved booking. Access permissions, validation and checks against intended changes therefore have different roles.

Denial prevents authorised users from accessing information or services when required. A DDoS attack can overwhelm a service while leaving its stored records intact. That is an availability impact without necessarily involving disclosure, alteration or destruction.

Availability can also fail through faults or dependencies; an outage alone does not prove a malicious denial-of-service attack. Describe the observed loss of access separately from the cause being investigated.

Denial and destruction are not identical. Some teaching materials expand DAD as Disclosure, Alteration and Destruction. This lesson uses Denial, and that is the wording used for the main comparison in this lesson.

Destruction concerns loss or damage to an asset, such as deletion of a document without a recoverable copy or physical damage that destroys stored information. Denial concerns preventing access to a resource. Destruction can cause denial, but denial can occur without destruction: an overloaded booking service can be unreachable even though its database remains intact.

A recoverable copy can change the recovery options after deletion, but it does not mean that users experienced no interruption. Conversely, availability loss does not by itself establish that stored data was destroyed. Examine the facts rather than treating the terms as synonyms.

If a course, book or examination question expands the final D as Destruction, follow its wording. The distinction still holds: ask whether something was lost or damaged, and separately whether people were prevented from reaching it.

When the contract was read (09:12), the confidentiality boundary failed, even though staff saw no change in the document. Restricting access and applying appropriate authentication and encryption can help protect that boundary. Encryption at rest does not prevent misuse if the compromised account is allowed to retrieve readable content through the application.

When the payment terms changed (09:20), staff could no longer simply rely on the current document. Editing permissions, protected change tracking and integrity checks can help prevent or reveal improper changes. Detection needs a trustworthy reference or authorised change record; logging that a change occurred does not establish whether it was correct. Recovery may require restoring and validating a known-good version.

When the service stopped (09:41), staff could not use it. Resilience and suitable capacity may reduce disruption, while backups and recovery planning may support restoration. Restoring the document alone may not restore the application, authentication or network services needed to reach it. Recovery arrangements need testing rather than an assumption that a stored copy is sufficient.

These measures overlap, but restoration does not undo disclosure. Even after a correct version is restored and the service is available again, the attacker may retain the information already obtained. The organisation still has to stop the access (containment), investigate, and meet any duties it has to the people whose information was read.

If the attacker only reads the confidential file and no change or interruption is established, the known outcome is disclosure. Do not automatically record all three objectives as affected. If a service is disrupted while the document stays intact and private, availability may be the only established impact. If the only usable copy is deliberately deleted, destruction is relevant and may also cause denial.

These comparisons preserve the distinction between what evidence establishes and what remains possible. One incident can affect all three objectives, but it does not have to.