CIA model describes the goals of security, while AAA framework describes a practical mechanism for achieving confidentiality and integrity in particular, by controlling and recording who can access what.
CIA Triad
- Confidentiality
Ensuring information is only accessible to those authorised to see it. Protects against unauthorised disclosure (e.g., encryption, access controls). - Integrity|
Ensuring data is accurate and hasn’t been tampered with or corrupted, whether by accident or malicious action (e.g., checksums, digital signatures, version control). - Availability
Ensuring systems and data are accessible to authorised users when needed (e.g., redundancy, backups, protection against denial-of-service attacks).
AAA Framework
- Authentication
Verifying who a user is (e.g., passwords, biometrics, multi-factor authentication). - Authorisation
Determining what an authenticated user is allowed to do (e.g., permissions, role-based access control – using Access Control Lists). - Accounting
Tracking what a user actually did – logging actions for monitoring, billing, or forensic review (e.g., analysing log files).