Security Assets and CIA Triad

A security asset is something whose compromise would matter: records, credentials, a service, or evidence of its actions. The CIA triad names three protection goals: confidentiality, integrity, and availability. The goals are different from the assets they protect.

One record needs three protections

For a fictional refund record, confidentiality limits who can read it. Integrity protects it from unauthorized alteration or destruction. Availability lets authorized staff obtain it when required.

An encrypted record may remain confidential while an outage makes it unavailable. Restricting reads alone does not prevent a privileged process from changing its amount.

Specify the consequence

Identify the asset, the relevant goal, and what failure would mean for the user. “Protect the model” is less informative than “prevent unauthorized replacement of the deployed model.” Use these statements to choose controls and observable tests.

Reference: NIST: Information Security.