Key points
- Identify tangible and intangible assets and connect each to the business workflow it supports
- Confidentiality, integrity, and availability are different loss stories on one system.
- Select technical and administrative safeguards that address the specific CIA property at risk rather than applying generic controls
Start with the asset and the mission workflow
Security architecture never starts by shopping for tools or debating firewall rules in the abstract. At Meridian Space & Robotics (chronos.orbital), Principal Security Architect Vera Vance starts every design review by asking the engineering team two questions: what specific asset lives here, and what mission workflow breaks if that asset is compromised?
In practice, an asset is anything of value to the organization. That includes databases, cryptographic signing keys, flight-control source code, ground-station hardware, engineer credentials, and mission reputation. Until an Individual Contributor (IC) maps how data flows across a system and who relies on it under time pressure, every control recommendation is guesswork.
| Security Objective | Opposite Failure (DAD) | Primary Technical Controls | Meridian Orbital Example |
|---|---|---|---|
| Confidentiality | Disclosure: unauthorized party reads sensitive data | AES-256 encryption at rest, TLS 1.3 in transit, least-privilege IAM, data classification labels | Protecting proprietary thruster calibration telemetry from competitor espionage |
| Integrity | Alteration: data or code is modified, forged, or replayed without detection | Cryptographic hashes (SHA-256), HMACs, digital signatures, immutable append-only logs, dual-control approvals | Verifying that an uploaded satellite burn-vector file was signed by flight dynamics and not altered in transit |
| Availability | Destruction or denial: authorized systems cannot access or process the asset on time | Active-active failover, multi-region load balancing, DDoS mitigation, RAID arrays, tested offline backups | Keeping the ground-station command uplink responsive during a 90-second low-earth-orbit pass window |
Confidentiality, integrity, and availability in tension
The CIA triad gives engineers three distinct lenses for evaluating failure. Confidentiality is violated when unauthorized actors read secret data. Integrity is violated when data, software, or configurations are altered without authorization or when a sender can forge a message. Availability is violated when authorized users or automated services cannot reach the system within the required operational window.
Crucially, a control that strengthens one pillar never automatically solves the other two, and controls often pull against each other. Encrypting a database with AES-256 protects confidentiality if a storage volume is stolen, yet an attacker with valid application credentials or an unauthenticated API flaw can still corrupt records (breaking integrity) or drop tables (breaking availability). Conversely, requiring manual three-person cryptographic approval before every database failover protects integrity but can delay recovery enough to violate a strict availability Service Level Objective (SLO).
Reverse the triad: Disclosure, Alteration, Destruction (DAD)
During threat modeling and certification exams alike, it helps to state the exact opposite of the CIA triad: Disclosure, Alteration, and Destruction (DAD). Naming the specific loss story prevents teams from deploying expensive confidentiality controls when the real operational hazard is silent alteration or service outage.
In safety-critical and industrial environments such as orbital telemetry or medical devices, the priority order often flips from traditional corporate IT. A hospital infusion pump or an orbital attitude-control loop places Integrity and Availability at the top of the risk register because corrupted telemetry or a delayed command can cause physical harm, whereas a delayed public status report is a minor inconvenience.
Walkthrough: one telemetry pipeline, three failure modes
Consider Meridian ground station chronos-gs-17, which receives real-time orbital position packets and relays maneuver commands. If an unauthenticated S3 bucket exposes archived telemetry logs to the public internet, Meridian suffers a Confidentiality loss even though the live satellites continue flying normally.
If a compromised build runner injects a two-degree offset into the maneuver calculation table without tripping a checksum alert, Meridian suffers an Integrity loss: the system is up and encrypted, but the numbers are lying. Finally, if a botnet saturates the ground-station receiver link during a scheduled collision-avoidance pass, Meridian suffers an Availability loss because the valid, encrypted command cannot arrive before the orbital window closes.
STEP THROUGH IT
One asset, three jobs
Each test changes one property. Real incidents can hit several.
One asset: Chronos Hub record MV-17, the approved burn vector for chronos-gs-17. C, I, and A ask different questions.
The burn vector is in a personal inbox. Which job failed?
Confidentiality. Dax Mercer is not an approved reader but receives a readable copy.
The saved burn vector now reads empty. Which job failed?
Integrity. The saved vector contradicts the approved burn vector. Fast access does not make the stored value correct.
Chronos Hub is offline and the pass window closes. Which job failed?
Availability. Flight dynamics cannot retrieve MV-17 by 06:00.
Step 1 of 4
Read the whole path as a list
Nothing plays on its own. Previous and Next move one beat. The list and the table say the same thing without motion.
Jobs hold
- One asset: Chronos Hub record MV-17, the approved burn vector for chronos-gs-17. C, I, and A ask different questions.Asset is current and reads record, MV-17 · burn vector. Confidentiality, Integrity, and Availability wait, one row each.
- Flight dynamics and ground crew read assigned burn vectors. Each tenant reads only its own. Approved readers pass.Confidentiality is current and reads assigned readers. Integrity and Availability wait.
- Integrity: approved edits keep the signed burn vector. An authorized editor can still make a mistake.Confidentiality holds. Integrity is current and reads approved + correct. Availability waits.
- Flight dynamics fetches MV-17 before the 06:00 pass. On time is not the same as correct.Confidentiality and Integrity hold. Availability is current and reads for the 06:00 pass.
Export leak
- Dax Mercer has a Hub login but no permission to read another tenant's burn vector.Asset is current. Confidentiality, Integrity, and Availability all hold with their usual values.
- Chronos Hub wrongly permits the export. A readable burn-vector copy arrives in Dax's personal inbox.Confidentiality is current and reads a personal inbox. Integrity and Availability still hold.
- Disclosure breaks confidentiality. The original is unchanged, and flight dynamics still fetches it.Confidentiality fails: an unapproved reader has a copy. Integrity and Availability hold.
False empty
- Someone submits a forged burn vector for chronos-gs-17 in place of approved MV-17.Asset is current. Confidentiality, Integrity, and Availability all hold with their usual values.
- The ground station accepts the forgery and saves MV-17's burn vector as empty.Integrity is current and reads EMPTY saved. The approved value is the signed burn vector. Confidentiality and Availability hold.
- Integrity fails: the saved vector contradicts the approved value. Access still works.Integrity fails: EMPTY contradicts the approved burn vector. Confidentiality and Availability hold.
Pass missed
- Flight dynamics reads MV-17 from Chronos Hub before the 06:00 pass at chronos-gs-17.Asset is current. Confidentiality, Integrity, and Availability all hold with their usual values.
- At 05:30 an outage stops Chronos Hub. The vector stays intact, but flight dynamics cannot fetch it.Availability is current: no record by 06:00. Confidentiality and Integrity hold.
- Availability fails: flight dynamics cannot fetch MV-17 by 06:00. The pass window closes.Availability fails: Chronos Hub is offline past 06:00. Confidentiality and Integrity hold.
Show as a table
Chronos Hub record MV-17 holds the approved burn vector for chronos-gs-17. Approved readers, correct values, and timely access are separate questions about it. The rows are not protection stages.
| Job or loss | What it settles | What it leaves open |
|---|---|---|
| Confidentiality | Flight dynamics and ground crew read assigned burn vectors. Each tenant reads only its own. | Correct values and timely access. |
| Integrity | Approved edits keep the signed burn vector. An authorized editor can still make a mistake. | Edit permission does not prove the vector is right. Readers and timely access stay open. |
| Availability | Flight dynamics retrieves MV-17 before the 06:00 pass. | A service that responds does not prove the vector is correct or that no copy leaked. |
| Export leak | Breaks at Confidentiality: a readable copy reaches Dax Mercer's personal inbox. | The original is unchanged, and flight dynamics still fetches it on time. |
| False empty | Breaks at Integrity: a forged vector makes the ground station save EMPTY instead of the approved burn vector for MV-17. | Nothing leaks, and access works, but the value stays wrong. |
| Pass missed | Breaks at Availability: an outage blocks authorized retrieval by 06:00. | The source vector stays intact, and nothing leaks. |
Scene checked 2026-10-15.
CHECK YOUR JUDGMENT
At Meridian Space & Robotics (chronos.orbital), Staff Infrastructure Engineer Kael Cho discovers that an internal microservice writes orbital maneuver parameters to an encrypted PostgreSQL database, but any container in the cluster can overwrite those rows without an audit signature or hash verification. Which security objective is primarily at risk, and which control directly addresses it?
NEXT FIELD LESSON