I am doing a course on cryptography, and there I learned that the major security goals are


Also I Learned that ITU-T provides 5 different security services

Data confidentiality
Data Integrity
Access Control

If there are only 3 security goals, why do we need these 5 services, and how does these services provide the above goals?


The real goal of Information Security is to protect information assets from harm.

The CIA triad breaks this down into preventing harm to three attributes of an asset. It's a useful model, because people often focus too much on confidentiality at the expense of integrity and availability.

It's not the only mental model. The Parkerian Hexad, for example, and the ITU-T model you mention is another.

For example, non-repudiation is clearly a very important attribute of some sorts of information asset, and needs to be protected from harm, but it doesn't fit very neatly into either C, I, or A. So other models can be useful.


All models are, by definition, simplistic in some way; they are models. That's their job.

At some point, someone coined the triad "confidentiality, integrity, authenticity" (I don't know who, but it is old). This is a mental framework: every information security concept can be forced into one of these three categories, sometimes with the help of the psychological equivalent of a sledgehammer. Later on, other people suggested to augment the model in various ways, e.g. the Parkerian hexad which extends the list to six categories.

It is relatively obvious that the less categories you have, the more approximate they will become. However, piling up extra categories does not guarantee that it will make the model more adequate. You should read these lists of categories as checklists: helpers to see whether you did not forget one facet of the problem at hand. But don't take them as Gospel. We already see too many people who try to one-up each other by their use of one more byzantine category.

In practical terms:

  • Confidentiality is about keeping information private.
  • Integrity is about keeping information unaltered. This is defined only with regards to a reference state ("this file is identical to what it was at time T on machine X").
  • Authenticity is "owned integrity": this is about integrity of some data where the reference state is "whatever some specific guy thought that it was". This morphs into authentication protocol, where the verifier makes sure that what it receives really comes from a specific prover (which, indirectly, may imply that the said prover was involved in the operation).
  • Availability is again a sub-category of integrity, where the "alteration" boils down to "the data is simply not there". Thinking about it as a specific category can be helpful in that malicious alterations (the bad guy flips some bits in a file) and wholesale unavailability (DoS attack, flood...) are so different in their modalities that keeping them under a single category is not a fruitful modelling.
  • Non-repudiation is an extension of authenticity, in that it adds an extra feature: third parties can be convinced. "Normal" authenticity is between a prover and a verifier; the verifier becomes convinced that the data at hand really comes from the prover. With non-repudiation, the verifier also obtains a proof that he may show to a third entity who would become equally convinced. This is the basis for digital signatures.
  • Access control is a bridge between confidentiality, integrity and authenticity. It begins with authentication, and then works out what data the authenticated individual may "access", where access is a combination of reading (that's confidentiality) and writing (that's integrity).

There are other classifications which can be useful in some contexts. For instance, in Identity Management, we would talk of identification, authentication and authorization:

  • Identification: "There is a user called Bob, born on xxxx-xx-xx, with employee number nnnnnn".
  • Authentication: "A user sent password 'B0bst4ongP4sswo0rd!' which matches the hashed password stored for Bob, so chances are that we are right now talking to Bob".
  • Authorization: "Bob can read columns X and Y in table Z of the database".

With these categories, "access control" becomes a sub-case of "authorization".


CIA and ITU-T are two different models. The CIA model is pretty simple, and allows you to split things into very high level concepts. ITU-T is less abstract, and aims more at the facets of confidentiality and integrity.

Let's look at the definitions for each of those first three:

  • Confidentiality - Only allowing authorised people to see certain data.
  • Integrity - Ensuring that unauthorised people can't modify data, or at least that we can detect if they did.
  • Availability - Making sure that authorised people can get access to the data they need.

Now let's look at the ITU-T ones:

  • Data confidentiality - As above.
  • Data integrity - As above.
  • Authentication - Ensuring that an identity is valid, so that we can provide the appropriate levels of authorisation.
  • Non-repudiation - A form of integrity control that ensures that once a party has made a statement, they cannot change or reject that statement at a later time.
  • Access control - Ensuring that authorisation is appropriately enforced

So how do they fit together?

ITU-T actually only provides confidentiality and integrity, in that authentication enforces identity, to which an authorisation level can be associated, which can in turn be used to enforce the correct access controls on data, and therefore ensure that confidentiality and integrity are maintained. Non-repudation is another kind of integrity enforcements.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.