All models are, by definition, simplistic in some way; they are models. That's their job.
At some point, someone coined the triad "confidentiality, integrity, authenticity" (I don't know who, but it is old). This is a mental framework: every information security concept can be forced into one of these three categories, sometimes with the help of the psychological equivalent of a sledgehammer. Later on, other people suggested to augment the model in various ways, e.g. the Parkerian hexad which extends the list to six categories.
It is relatively obvious that the less categories you have, the more approximate they will become. However, piling up extra categories does not guarantee that it will make the model more adequate. You should read these lists of categories as checklists: helpers to see whether you did not forget one facet of the problem at hand. But don't take them as Gospel. We already see too many people who try to one-up each other by their use of one more byzantine category.
In practical terms:
- Confidentiality is about keeping information private.
- Integrity is about keeping information unaltered. This is defined only with regards to a reference state ("this file is identical to what it was at time T on machine X").
- Authenticity is "owned integrity": this is about integrity of some data where the reference state is "whatever some specific guy thought that it was". This morphs into authentication protocol, where the verifier makes sure that what it receives really comes from a specific prover (which, indirectly, may imply that the said prover was involved in the operation).
- Availability is again a sub-category of integrity, where the "alteration" boils down to "the data is simply not there". Thinking about it as a specific category can be helpful in that malicious alterations (the bad guy flips some bits in a file) and wholesale unavailability (DoS attack, flood...) are so different in their modalities that keeping them under a single category is not a fruitful modelling.
- Non-repudiation is an extension of authenticity, in that it adds an extra feature: third parties can be convinced. "Normal" authenticity is between a prover and a verifier; the verifier becomes convinced that the data at hand really comes from the prover. With non-repudiation, the verifier also obtains a proof that he may show to a third entity who would become equally convinced. This is the basis for digital signatures.
- Access control is a bridge between confidentiality, integrity and authenticity. It begins with authentication, and then works out what data the authenticated individual may "access", where access is a combination of reading (that's confidentiality) and writing (that's integrity).
There are other classifications which can be useful in some contexts. For instance, in Identity Management, we would talk of identification, authentication and authorization:
- Identification: "There is a user called Bob, born on xxxx-xx-xx, with employee number nnnnnn".
- Authentication: "A user sent password 'B0bst4ongP4sswo0rd!' which matches the hashed password stored for Bob, so chances are that we are right now talking to Bob".
- Authorization: "Bob can read columns X and Y in table Z of the database".
With these categories, "access control" becomes a sub-case of "authorization".