In CIA triad of information security, what's the difference between confidentiality and availability?

Question

I sometimes get confused between confidentiality and availability. This site defines confidentiality as

Measures undertaken to ensure confidentiality are designed to prevent sensitive information from reaching the wrong people, while making sure that the right people can in fact get it

and availability as

Availability of information refers to ensuring that authorized parties are able to access the information when needed.

What's the difference? Is confidentiality more about restricting and availability is more about permitting?

Answer 1

Confidentiality is concerned with ensuring unauthorised users cannot access a protected resource.

Availability is concerned with ensuring authorised can access a protected resource.

It is important that a resource is available, because otherwise an attacker might cause damage simply by preventing authorised users from accessing a resource, even without the attacker being able to access the resource themselves.

A physical metaphor for availability might be an attacker going to all the fire escapes on a building and bolting them shut from the outside. The attacker doesn't need to compromise the existing locks to do this (and therefore they can't get inside the building themselves), but if there's a fire the attacker can still cause significant harm.

Answer 2

Is confidentiality more about restricting and availability is more about permitting?

No, both permitting and restricting are about confidentiality.

1. Confidentiality: a set of rules that limits access to a certain data. The permissions/privileges set for users are definitely a confidentiality measure as they define levels of restrictions of access to some information/resources.

2. Availability: suppose a company's website becomes a victim of successful DoS attack, the resources of that website are no longer available to its customers. Availability is thus about information being available when it is needed but only to people who are supposed to have right to access to it.