When a protection goal is violated, how quickly is the violation typically detected — and why does this differ per goal?
Availability is noticed immediately; integrity/authenticity fairly soon; confidentiality often late or never.
* Detection latency by violated goal — availability outages surface instantly, integrity failures fairly soon, confidentiality breaches often late or never. *
| Goal violated | Typically detected |
|---|---|
| Availability | immediately (the system is down) |
| Integrity / Authenticity | soon (something looks wrong / checks fail) |
| Confidentiality | late or never (data is copied silently) |
Why this asymmetry matters: the worst breaches are confidentiality breaches precisely because they're invisible — copying data leaves the original untouched. This is the security version of "you can't tell someone read your letter if they put it back." It's also the argument for detective controls (logging, DLP, anomaly detection) on top of preventive ones.
Go deeper:
Data breach (Wikipedia) — confirms confidentiality breaches often go undetected and are frequently found only by third parties — the asymmetry the card explains.