Confidentiality, Integrity and Availability

The previous curriculum measured the same thing across five courses: when a layer was leased, which decision got handed off and which number improved in return. Leasing and buying alike carried the same silent assumption — that only the authorized reach that layer. This lesson removes that assumption and puts three separate questions in its place: who can see the data, who can change it, who can reach it when they need to.

These three questions are security’s three axes: confidentiality, integrity, and availability. Taken one at a time, all three look beyond dispute. Set on the same asset together, they push against each other: a decision that raises one axis usually lowers another. What this lesson measures is that push — how many items gain on which axis, and how many lose.

The Three Axes Sit on the Same Asset

The example is the fictional regional measurement network that runs through the whole curriculum: a service that collects water-meter readings, a service that validates them, billing and work-order services, field crews, and branch endpoints. Both the network and the assets are fictional; the scores below are a model, not a measurement taken on a real system.

SC1: the asset inventory is eight items. SC2: every asset carries a base score between 0 and 10 on each of three axes; the score shows how well that axis is provided for that item. SC3: every security decision touches specific items and writes a separate delta on each of the three axes; the score never drops below 0 or rises above 10. SC4: two of the decisions carry a collapse condition — if the condition fires, availability for the items that decision touches is zeroed. SC5: decisions are applied in list order; the clamp acts at every step.

// security/axis.mjs — fictional regional measurement network's asset inventory and three-axis model
// (model): there is no real network, real asset record, or real security measurement. No randomness.

export const AXIS = ["con", "int", "avl"];
export const CLAMP = (x) => Math.max(0, Math.min(10, x));

// SC2: every asset carries a 0..10 base score on three axes; scores are fictional.
export const ASSET = `
  reading-data         4 5 6
  billing-record       5 6 5
  work-order-queue     3 5 7
  identity-store       6 6 5
  configuration        4 6 6
  audit-log            5 4 5
  meter-firmware       3 7 6
  field-app            4 5 7`
  .trim().split("\n").map((r) => {
    const [name, ...p] = r.trim().split(/\s+/);
    return { name, base: Object.fromEntries(AXIS.map((a, i) => [a, +p[i]])) };
  });

// SC3: every decision touches a subset of items and writes a delta on three axes.
// SC4: if a collapse condition fires, availability for those items is zeroed.
export const DECISION = [
  { name: "encryption-at-rest", d: { con: 4, int: 0, avl: -1 }, collapse: "key-loss",
    item: ["reading-data", "billing-record", "identity-store", "audit-log"] },
  { name: "nightly-backup", d: { con: -2, int: 1, avl: 3 }, collapse: null,
    item: ["reading-data", "billing-record", "work-order-queue", "configuration", "audit-log"] },
  { name: "append-only-log", d: { con: 0, int: 4, avl: -1 }, collapse: null,
    item: ["audit-log", "billing-record"] },
  { name: "multi-factor-login", d: { con: 3, int: 1, avl: -2 }, collapse: "agent-loss",
    item: ["identity-store", "configuration", "field-app"] },
  { name: "signed-firmware", d: { con: 0, int: 4, avl: -2 }, collapse: null,
    item: ["meter-firmware", "field-app"] },
  { name: "second-copy", d: { con: -2, int: -1, avl: 3 }, collapse: null,
    item: ["reading-data", "billing-record", "work-order-queue"] },
];

export function apply(collapsed = []) {
  const s = Object.fromEntries(ASSET.map((v) => [v.name, { ...v.base }]));
  for (const k of DECISION)
    for (const name of k.item)
      for (const a of AXIS) s[name][a] = CLAMP(s[name][a] + k.d[a]);
  for (const k of DECISION)
    if (k.collapse && collapsed.includes(k.collapse))
      for (const name of k.item) s[name].avl = 0;
  return s;
}

// How many (item, axis) pairs a single decision raises and lowers on its own.
export function impact(k) {
  const up = k.item.length * AXIS.filter((a) => k.d[a] > 0).length;
  const down = k.item.length * AXIS.filter((a) => k.d[a] < 0).length;
  return { up, down, net: k.item.length * AXIS.reduce((a, ax) => a + k.d[ax], 0),
    worst: Math.min(...AXIS.map((a) => k.d[a])) };
}

export const total = (s, a) => ASSET.reduce((acc, v) => acc + s[v.name][a], 0);

// security/measure.mjs — three axes on the same asset: who rises, who falls, what collapses.
import { AXIS, ASSET, DECISION, apply, impact, total } from "./axis.mjs";

const write = (g, ...s) => console.log(s.map((v, i) =>
  (g[i] < 0 ? String(v).padEnd(-g[i]) : String(v).padStart(g[i]))).join(""));
const base = Object.fromEntries(ASSET.map((v) => [v.name, { ...v.base }]));
const after = apply();

console.log(`${ASSET.length} assets x ${AXIS.length} axes, ${DECISION.length} decisions; ` +
  `score range 0..10 (con confidentiality, int integrity, avl availability)`);

const A = [-21, 6, 6, 6, 4, 7, 6, 6];
console.log("\n1. base score and score after all six decisions");
write(A, "asset", "con", "int", "avl", "", "con'", "int'", "avl'");
for (const v of ASSET)
  write(A, v.name, ...AXIS.map((a) => base[v.name][a]), "", ...AXIS.map((a) => after[v.name][a]));
write(A, "total", ...AXIS.map((a) => total(base, a)), "", ...AXIS.map((a) => total(after, a)));

const B = [-22, 7, 10, 8, 7, 15];
console.log("\n2. how many (item, axis) pairs a decision raises and lowers");
write(B, "decision", "items", "up", "down", "net", "worst axis");
for (const k of DECISION) {
  const e = impact(k);
  write(B, k.name, k.item.length, e.up, e.down, (e.net > 0 ? "+" : "") + e.net,
    AXIS.find((x) => k.d[x] === e.worst) + " " + e.worst);
}
const T = DECISION.map(impact);
write(B, "TOTAL", DECISION.reduce((a, k) => a + k.item.length, 0),
  T.reduce((a, e) => a + e.up, 0), T.reduce((a, e) => a + e.down, 0),
  "+" + T.reduce((a, e) => a + e.net, 0), "-");

const C = [-16, 12, 12, 12, 16];
console.log("\n3. when a collapse condition fires (availability is zeroed)");
write(C, "condition", "con total", "int total", "avl total", "avl = 0 items");
for (const [name, cs] of [["no collapse", []], ["key-loss", ["key-loss"]],
  ["agent-loss", ["agent-loss"]], ["both", ["key-loss", "agent-loss"]]]) {
  const s = apply(cs);
  write(C, name, ...AXIS.map((a) => total(s, a)),
    ASSET.filter((v) => s[v.name].avl === 0).length + "/" + ASSET.length);
}

const D = [-21, 10, 11, 8];
console.log("\n4. lowest axis per asset (no collapse, then key loss)");
write(D, "asset", "lowest", "collapsed", "axis");
const broken = apply(["key-loss"]);
for (const v of ASSET) {
  const a = Math.min(...AXIS.map((x) => after[v.name][x]));
  const b = Math.min(...AXIS.map((x) => broken[v.name][x]));
  write(D, v.name, a, b, AXIS.find((x) => broken[v.name][x] === b));
}
const avg = (s) => (AXIS.reduce((a, x) => a + total(s, x), 0) / (ASSET.length * 3)).toFixed(1);
write(D, "average score", avg(after), avg(broken), "-");

8 assets x 3 axes, 6 decisions; score range 0..10 (con confidentiality, int integrity, avl availability)

1. base score and score after all six decisions
asset                   con   int   avl       con'  int'  avl'
reading-data              4     5     6          4     5    10
billing-record            5     6     5          5     9     9
work-order-queue          3     5     7          0     5    10
identity-store            6     6     5         10     7     2
configuration             4     6     6          5     8     7
audit-log                 5     4     5          7     9     6
meter-firmware            3     7     6          3    10     4
field-app                 4     5     7          7    10     3
total                    34    44    47         41    63    51

2. how many (item, axis) pairs a decision raises and lowers
decision                items        up    down    net     worst axis
encryption-at-rest          4         4       4    +12         avl -1
nightly-backup              5        10       5    +10         con -2
append-only-log             2         2       2     +6         avl -1
multi-factor-login          3         6       3     +6         avl -2
signed-firmware             2         2       2     +4         avl -2
second-copy                 3         3       6      0         con -2
TOTAL                      19        27      22    +38              -

3. when a collapse condition fires (availability is zeroed)
condition          con total   int total   avl total   avl = 0 items
no collapse               41          63          51             0/8
key-loss                  41          63          24             4/8
agent-loss                41          63          39             3/8
both                      41          63          14             6/8

4. lowest axis per asset (no collapse, then key loss)
asset                    lowest  collapsed    axis
reading-data                  4          0     avl
billing-record                5          0     avl
work-order-queue              0          0     con
identity-store                2          0     avl
configuration                 5          5     con
audit-log                     6          0     avl
meter-firmware                3          3     con
field-app                     3          3     avl
average score               6.5        5.3       -

Numbers belong to the measurement class; their inputs are SC1–SC5.

A Decision Works in Two Directions at Once

The second table reduces the six decisions to a single measure: how many (item, axis) pairs each decision raises, and how many it lowers. In total, 27 pairs rise, 22 fall. None of the six decisions raises only — even encryption-at-rest, which has the highest net value, lowers availability by one point on each of the four items it touches.

The reading-data row in the first table is the clearest form of that push. Its confidentiality score starts at 4, encryption raises it to 8, the nightly backup drops it to 6, the second copy drops it to 4. The item is encrypted and its confidentiality score is exactly where it started. The reason is plain: encryption protects the data in one place, while the backup and the copy multiply that same data in two more places. The same row’s availability climbs from 6 to 10 — the gain is real, but it is paid for on the confidentiality axis.

The work-order-queue row is where the clamp does its work: confidentiality starts at 3, two decisions each take two points, and the score stops at 0. Once an axis has hit the floor, there is nothing left to pay on that axis; the next decision starts drawing the same cost from a different item. The opposite end is identity-store: confidentiality climbs from 6 to 10, the ceiling, while availability in return falls from 5 to 2. An axis pinned to the ceiling means that taking any further confidentiality decision on that item produces only an availability cost.

A Decision with Zero Net Effect

The second-copy row is the most instructive item in the second table: its net value is exactly zero. It touches three items, raises three pairs, lowers six. It gains three points of availability per item (+9 total), while costing two points of confidentiality (−6) and one point of integrity (−3) per item. A reading that reduces the total to a single number counts this decision as “no effect” and drops it from the agenda.

But the decision’s meaning is in its distribution, not its total. The same row carries three separate questions: the copy keeps readings reachable during an outage; that same copy makes the data visible in one more place; and temporary inconsistency between the copies weakens integrity. These three do not cancel each other out, because they are paid on different events. A net of zero does not mean three separate risks canceled one another; it means three separate ledgers were summed into one row.

The same measure works for comparison too. nightly-backup raises ten pairs and lowers five, for a net of +10; encryption-at-rest raises four and lowers four, for a net of +12. Counting by pairs, the backup is broader; counting by net value, encryption is deeper. The two are not comparable; no defense can be called “better” without saying on which axis it was measured.

Every Asset’s Dominant Axis Is Its Own

The last columns of the first table give a third reading: once the same decisions have been applied, the eight assets do not land in the same place on all three axes. meter-firmware sits at 10 on integrity and 4 on availability; work-order-queue sits at 10 on availability and 0 on confidentiality. Both items belong to the same network and passed through the same set of decisions, yet one accumulated toward integrity and the other toward availability.

The difference is not chance; it comes from what the item does. Meter firmware runs on a field device: running the wrong version corrupts every reading, while going unpatched for a few hours corrupts nothing. The work-order queue runs the opposite way: who sees a record inside it is a low cost, while the queue going down leaves field crews waiting. The same three axes fall into two different rankings across two items.

The practical consequence is that a single security goal cannot hold across the whole inventory. The rule “confidentiality comes first” has already hit the floor for work-order-queue, leaving nothing left to apply there; the same rule has pinned identity-store to the ceiling and started producing nothing but an availability cost. Axis priority is set per asset, not per organization — and the scores counted through this lesson are the one record of where that priority lands on each item.

A Collapse Zeroes One Axis

The third table runs the decisions’ collapse conditions. When the encryption key is lost, the confidentiality total stays at 41 — arguably still protected, since no one can read the data. At the same time, the availability total drops from 51 to 24 and four of eight assets are zeroed. When the multi-factor login’s authenticator device is lost, availability drops to 39 and three items are zeroed. When both conditions fire together, the total is 14 and six of the eight items are unreachable.

What these rows share is that the confidentiality and integrity columns never move. The defense that collapses does not break on its own axis; it keeps its promise more than fully. The whole cost is written to the third axis. A reading that does not count availability as a security axis sees no problem at all in this table — because the two columns it is watching stay fixed.

What the Average Conceals

The fourth table reads the same situation per asset and shows how a single number misleads. On key loss, four of the eight assets drop to zero on their lowest axis. At the same time, the average score falls only from 6.5 to 5.3. Four of twenty-four cells have been zeroed, and a dashboard watching a single number records that as a one-point decline.

The reason is in the distribution: the other two axes of the zeroed items stay high, which keeps the average up. reading-data sits at 4 on confidentiality, 5 on integrity, and 0 on availability; its average is 3 and looks “moderate.” But if that item cannot be reached, its confidentiality score has no practical payoff. The three axes do not add up; the lowest axis determines the item’s real condition.

Two rows in the table also show this limit: configuration and meter-firmware are not affected by key loss at all, because they are not among the items the encryption decision touches. The scope of a collapse is the set of items the collapsing defense touches — nothing wider. Everything counted through this lesson stands on those sets, and the lessons that follow will give the same sets other names.

Summary

• The three axes overlap on the same asset: in a model with eight assets and six decisions, 27 (item, axis) pairs rise while 22 fall; none of the six decisions runs in only one direction.
• The encrypted reading-data item’s confidentiality score rises from 4 and returns to 4, because the backup and the second copy multiply the same data; its availability, meanwhile, climbs from 6 to 10.
• The zero-net second-copy decision writes +9 on availability, −6 on confidentiality, and −3 on integrity; when the total is reduced to one row, the three separate ledgers disappear.
• On key loss the confidentiality and integrity totals never move, availability drops from 51 to 24, and four of eight assets are zeroed; the two collapse conditions together write 14 and six items.
• The same zeroing shows up in the average as only a drop from 6.5 to 5.3; an item’s condition is set by its lowest axis, not the average.
• The scope of a collapse is the set of items the collapsing decision touches; two assets are entirely unaffected by key loss.

Next Step

This lesson scored eight items and counted which direction six decisions moved those scores. But the whole computation ran on a single list, and that list’s parts were left unnamed: what exactly was the thing called “asset,” what was the name of the thing decisions counter, what was the thing that lowers a score actually called. The next lesson splits the same inventory into three separate lists — asset, threat, and vulnerability — and shows why multiplying the three does not give the number of reachable paths.