CIA Security Triad（信息安全三要素）
一、概念解释 / Concept Explanation
English:
The CIA Security Triad is a fundamental model in information security that stands for Confidentiality , Integrity , and Availability .
It represents the three main goals of protecting data and systems.
中文：
CIA 安全三元组 是信息安全中最基本的模型，代表 机密性（Confidentiality） 、完整性（Integrity） 和 可用性（Availability） 。
它反映了保护数据和系统的三大核心目标。
C --- Confidentiality（机密性）
English:
Confidentiality means ensuring that sensitive information is accessible only to authorized people.
中文：
机密性指确保敏感信息仅能被授权人员访问。
English:
Common methods include encryption, authentication, and access control.
中文：
常见手段包括加密、身份验证与访问控制。
💡 Metaphor 比喻:
Like locking your diary --- only you (authorized user) have the key to read it.
就像锁住你的日记，只有你（被授权者）能看。
I --- Integrity（完整性）
English:
Integrity ensures that data remains accurate, consistent, and unaltered by unauthorized users.
中文：
完整性指数据保持准确一致，未经授权不得被篡改。
English:
Techniques include checksums, digital signatures, and version control.
中文：
技术手段包括校验和、数字签名和版本控制。
💡 Metaphor 比喻:
Like sealing an envelope --- if the seal is broken, you know the message was tampered with.
就像封信封口，如果封条破了，就知道内容被改过。
A --- Availability（可用性）
English:
Availability means ensuring that systems and data are accessible when needed.
中文：
可用性意味着确保系统与数据在需要时可以被访问。
English:
This involves redundancy, backups, fault tolerance, and DDoS protection.
中文：
这包括冗余、备份、容错以及防止拒绝服务攻击。
💡 Metaphor 比喻:
Like keeping a spare key --- even if the main one is lost, you can still get into your house.
就像备一把备用钥匙，即使主钥匙丢了也能进门。
二、核心总结 / Key Takeaways
| Element | English Summary | 中文总结 |
|---|---|---|
| Confidentiality | Keep secrets safe | 保护机密信息 |
| Integrity | Keep information correct | 确保数据正确未被改动 |
| Availability | Keep services running | 确保系统持续可访问 |
| Goal | Balance all three aspects | 平衡三者的重要性 |
三、选择题（Multiple Choice Questions）×5
Q1:
EN: What does the "C" in CIA stand for?
CN: CIA 中的 "C" 代表什么？
A. Control
B. Confidentiality ✅
C. Certification
D. Connection
✅ Correct: B
Why: It refers to keeping information private from unauthorized users.
为什么对: 它指的是防止未授权用户访问信息。
Why wrong:
A ❌ Control 不是核心概念。
C ❌ Certification 是验证，不属于三元组。
D ❌ 与安全目标无关。
Q2:
EN: Which example best represents Integrity ?
CN: 以下哪个例子最能体现"完整性"？
A. Using encryption
B. Having a backup system
C. Checking file hashes before upload ✅
D. Using two-factor authentication
✅ Correct: C
Why: Hash checking ensures data wasn't modified.
为什么对: 校验哈希可确保文件未被修改。
Why wrong:
A ❌ 属于机密性。
B ❌ 属于可用性。
D ❌ 属于身份验证。
Q3:
EN: Which threat affects Availability the most?
CN: 哪种威胁最影响"可用性"？
A. DDoS attack ✅
B. Data leak
C. SQL injection
D. Password guessing
✅ Correct: A
Why: DDoS makes services unavailable.
为什么对: DDoS 会导致系统无法访问。
Why wrong:
B ❌ 是机密性问题。
C ❌ 更多影响完整性。
D ❌ 属于认证威胁。
Q4:
EN: What practice supports Confidentiality ?
CN: 下列哪种做法有助于保持"机密性"？
A. Encrypting data ✅
B. Performing backups
C. Using checksums
D. Increasing bandwidth
✅ Correct: A
Why: Encryption prevents unauthorized reading.
为什么对: 加密能防止未授权访问数据。
Why wrong:
B ❌ 是可用性。
C ❌ 是完整性。
D ❌ 与安全无关。
Q5:
EN: What happens if Integrity is lost?
CN: 如果完整性丧失会怎样？
A. Data becomes unavailable
B. Data is modified without authorization ✅
C. Users can't log in
D. Information is encrypted
✅ Correct: B
Why: Loss of integrity means unauthorized data changes.
为什么对: 完整性丧失表示数据被未经许可修改。
Why wrong:
A ❌ 这是可用性问题。
C ❌ 认证失败属于访问控制问题。
D ❌ 加密并非错误。
四、简答题（Short Answer Questions）×5
Q1:
EN: Explain the CIA triad in simple words.
CN: 用简单语言解释 CIA 三元组。
A: CIA stands for Confidentiality, Integrity, and Availability --- three key goals to keep information safe, accurate, and accessible.
中文: CIA 代表机密性、完整性和可用性，是保护信息安全、准确与可访问的三大核心目标。
Q2:
EN: Why is balancing CIA important?
CN: 为什么平衡 CIA 三者很重要？
A: Over-focusing on one (e.g., encryption) might reduce another (e.g., availability). Security should protect data while keeping systems usable.
中文: 过分强调某一方面（如加密）可能降低其他方面（如可用性），安全应在保护数据与系统可用性间保持平衡。
Q3:
EN: Give one real-life example for each of C, I, and A.
CN: 给出一个关于 C、I、A 的现实例子。
A:
- C: Encrypting emails (防止泄露)
- I: Using digital signatures (防止篡改)
- A: Setting up redundant servers (防止中断)
Q4:
EN: How can a company ensure Integrity of its data?
CN: 公司如何确保数据的完整性？
A: By using hashing, version control, and access restrictions to detect or prevent unauthorized changes.
中文: 通过哈希校验、版本控制和访问限制检测并防止未授权更改。
Q5:
EN: What metaphor helps remember CIA?
CN: 用一个比喻帮助记住 CIA 模型。
A: CIA is like a secure bank vault ---
- Confidentiality: only staff can enter,
- Integrity: money counts must stay correct,
- Availability: customers can still withdraw during hours.
中文: CIA 就像银行金库： - 机密性： 只有员工能进；
- 完整性： 钱的数目必须正确；
- 可用性： 客户能正常取钱。
五、总结 / Summary
English:
The CIA triad is the foundation of information security.
Every security policy, tool, and defense strategy is designed to protect these three values --- keeping data secret, correct, and available.
中文：
CIA 三元组是信息安全的核心基础。
所有安全策略与防御措施的目的，都是为了保证数据的保密性、完整性与可用性。
✅ Best Practices / 实践建议
- Encrypt sensitive data at rest and in transit.
- Implement integrity checks (hashes, signatures).
- Maintain system availability with redundancy and backups.
- Regularly review security controls for balance among C, I, and A.