Confidentiality
Confidentiality ensures that information is only accessible to those who are authorized to see it. This is achieved through encryption, which transforms data into an unreadable form without the proper key. In cybersecurity, confidentiality applies to different data states:
-
Data in transit: Information moving across networks—such as emails, instant messages, or files transferred over the internet—must be protected against interception through protocols like TLS or VPN encryption.
-
Data at rest: Stored information—on hard drives, solid-state drives, backup media, or cloud storage—requires encryption to prevent access if the storage medium is lost, stolen, or improperly disposed of.
-
Data in use: Data currently being processed in memory can also be at risk, especially from advanced attacks that scrape RAM or exploit CPU vulnerabilities; emerging technologies such as confidential computing aim to address this.
Different protection levels apply depending on the storage structure and operational requirements:
-
Full-disk encryption protects the entire drive, requiring decryption at boot.
-
Partition encryption secures specific sections of the drive, useful for multi-OS environments.
-
File-level and volume encryption targets individual files or specific storage volumes, allowing more granular access control.
Database encryption can occur at the database level (encrypting the entire database instance) or at the record level (encrypting specific records or fields, often containing personally identifiable information or sensitive financial data).
Confidentiality is only as strong as the key management supporting it—strong encryption can be rendered useless if keys are poorly protected or shared insecurely.
Integrity
Integrity ensures that information remains accurate, complete, and unaltered except by authorized entities. Even if a message or file remains confidential, unauthorized modification can be equally damaging. Cryptographic hash functions play a major role in integrity verification by generating a fixed-length digest from the data; any change to the input produces a completely different hash. Integrity checks are used in software distribution (e.g., verifying file checksums), data storage systems, and secure communications to detect tampering.
Authentication
Authentication verifies the identity of an entity—be it a user, device, or system—before granting access or trusting communications. Cryptography supports authentication through mechanisms like digital certificates and challenge–response protocols. For example, when connecting to a secure website, the browser uses PKI-based certificates to confirm the site is genuinely operated by its claimed organization. In user authentication, cryptographic protocols ensure that passwords or other credentials are never transmitted in cleartext and that both parties can prove their identities without exposing secrets.