Confidentiality, integrity, availability, privacy and AAA

Separate the security objectives

Confidentiality limits access and disclosure to authorized parties. Integrity concerns accuracy and completeness, including protection against accidental corruption. Availability concerns access and use by authorized parties when needed. These objectives can fail independently: a public, functioning website can publish incorrect prices, and a confidential database can be unavailable.

Separate identity, permission and records

Authentication checks evidence for an identity claim. Authorization determines permitted actions. Accounting records relevant activity so that actions can be traced and reviewed. They are related but distinct: a public page can be authorized for anonymous reading, while a named employee can authenticate successfully and still lack permission to change a record. A log is useful evidence, not an automatic guarantee that a human identity has been proven.

Privacy has a wider purpose

Privacy concerns the appropriate handling of information about people, including its purpose and limits. The EDPB’s EU/EEA example covers more than citizenship: establishment, offering goods or services and monitoring can matter. Its principles include lawful and transparent handling, limited purposes and collection, accuracy, limited retention, security and demonstrable accountability. Do not infer that a particular small-business headcount automatically settles DPO obligations; relevant activities and legal context matter.

Non-repudiation depends on evidence

Non-repudiation concerns evidence that can help counter a later denial of an action. Digital signatures can support it when identity binding, key protection and verification are sound. It is not a promise that a person can never dispute an action or that a court must accept a particular record.

Apply CIA to AI inputs and outputs

Editorial application: protect sensitive training or input information from unauthorized disclosure, protect models and data against unauthorized changes, and consider the impact of an unavailable or unreliable AI service. One event can affect more than one security objective. NIST distinguishes manipulation of training data from direct model manipulation; protecting a dataset alone does not cover every poisoning path.

Connect the terminology.