What does the CIA triad stand for, and what extensions exist?

CIA = Confidentiality, Integrity, Availability — the three classic information security goals. Extensions add Accountability, Authenticity, and Non-Repudiation.

* The CIA triad: Confidentiality, Integrity, Availability. *

The Classic CIA Triad:

Extended properties:

• Accountability (Verbindlichkeit) — actions can be traced to a responsible entity
• Authenticity (Authentizität) — the identity of a subject/object can be verified
• Non-repudiation — a party cannot deny having performed an action

Accountability vs non-repudiation — related, but not just "stronger" versions of each other:

• Accountability is internal traceability: the system's logs tie an action to an entity, enough for the operator to know who did what. It rests on trusted logging — convincing to whoever controls the logs.
• Non-repudiation is externally provable: a digital signature yields evidence a neutral third party (e.g. a court) will accept, because only the actor could have produced it — so the actor can't deny it even to an outsider.

So non-repudiation is stronger, but the real jump is qualitative: the proof moves from trusted logs to cryptographic evidence anyone can verify.

Important nuance:

• The usual CIA triad from IT security is not quite sufficient for cryptography
• In crypto, the focus is primarily on Confidentiality and Data Authenticity/Integrity
• Availability is typically NOT a cryptographic concern (it's more of a systems/network concern)
• Data integrity is a component of data authenticity (authenticity includes: correct sender, time, origin, no replay, non-repudiation)

Go deeper:

• Information security - defines the CIA triad and its extensions (authenticity, accountability, non-repudiation).