Introduction
Almost every security framework starts with three words: confidentiality, integrity, availability. They are easy to recite and surprisingly hard to apply. This article treats them as a decision tool rather than a definition to memorise.
How it works
Confidentiality means only the right people can read something. Integrity means nobody can change it without being detected. Availability means the people who need it can reach it when they need it.
The interesting part is the tension. Encrypting a database improves confidentiality and can hurt availability if the key is lost. Aggressive rate limiting improves integrity and availability under attack, and can lock out legitimate users. Every control you add moves you along all three axes at once, and pretending otherwise is how teams end up with security nobody can work with.
Common risks
Teams that optimise only for confidentiality build systems so locked down that staff route around them. Teams that optimise only for availability leave data readable to anyone who asks. Both failures are common and both are avoidable by naming the trade-off explicitly.
How to detect it
When reviewing a control, ask which of the three it improves and which it degrades. If nobody can answer, the control has not been thought through. Look for signs of routing around: shared credentials, exported spreadsheets, personal cloud accounts.
How to defend
Write the trade-off down when you make a decision. Classify data so you know what actually needs strict confidentiality. Test your backups, because untested backups are an availability failure waiting to happen. Review access on a schedule, not on incident.