FC0-U61 Objective 6.1: Summarize Confidentiality, Integrity and Availability Concerns

September 16, 2025•28 min read•CompTIA IT Fundamentals

FC0-U61 Exam Focus: This objective covers the three fundamental pillars of information security: confidentiality, integrity, and availability (CIA triad). Understanding these security concerns including confidentiality threats (snooping, eavesdropping, wiretapping, social engineering, dumpster diving), integrity threats (man-in-the-middle, replay attack, impersonation, unauthorized information alteration), and availability threats (denial of service, power outage, hardware failure, destruction, service outage) is essential for IT security awareness and protection.

Understanding the CIA Triad

The CIA Triad represents the three fundamental principles of information security: Confidentiality, Integrity, and Availability. These principles form the foundation of information security and guide the development of security policies, procedures, and controls. Understanding these concepts and their associated threats is crucial for anyone working in IT, as they help identify vulnerabilities and implement appropriate security measures.

The CIA Triad Components:

Confidentiality: Ensuring that information is accessible only to authorized individuals
Integrity: Ensuring that information remains accurate and unmodified
Availability: Ensuring that information and systems are accessible when needed

Confidentiality Concerns

Confidentiality refers to protecting information from unauthorized access and disclosure. Various threats can compromise the confidentiality of sensitive information:

Snooping

Snooping involves unauthorized viewing or monitoring of information without permission:

Snooping Characteristics:

Unauthorized access: Viewing information without proper authorization
Covert observation: Secretly monitoring activities or data
Shoulder surfing: Looking over someone's shoulder to see sensitive information
Screen peeking: Viewing computer screens from a distance
Document viewing: Reading documents left unattended
Network monitoring: Intercepting network traffic
Keystroke logging: Recording keyboard input
Visual surveillance: Using cameras or other visual monitoring

Snooping Examples

Common Snooping Scenarios:

Office environment: Colleagues looking at computer screens while walking by
Public spaces: People watching others enter passwords on mobile devices
ATM usage: Criminals watching people enter PIN numbers
Wi-Fi networks: Unauthorized users monitoring network traffic
Printers: Viewing documents left on shared printers
Desk areas: Reading documents left on desks or in open areas
Video calls: Unauthorized people watching video conferences
Mobile devices: Viewing information on unlocked phones or tablets

Eavesdropping

Eavesdropping involves secretly listening to conversations or communications:

Eavesdropping Characteristics:

Audio interception: Listening to conversations without permission
Communication monitoring: Intercepting phone calls, emails, or messages
Passive listening: Secretly listening without being detected
Recording capabilities: Recording conversations for later use
Wireless interception: Intercepting wireless communications
Network sniffing: Capturing network traffic
VoIP interception: Intercepting voice over IP communications
Radio frequency monitoring: Monitoring radio communications

Eavesdropping Examples

Eavesdropping Scenarios:

Phone conversations: Listening to phone calls on unsecured lines
Video conferences: Unauthorized access to video meeting rooms
Public Wi-Fi: Intercepting data transmitted over public networks
Bluetooth devices: Intercepting Bluetooth communications
Office conversations: Listening to sensitive discussions in open areas
Network traffic: Capturing unencrypted network communications
Mobile communications: Intercepting text messages or calls
Radio communications: Monitoring two-way radio or walkie-talkie communications

Wiretapping

Wiretapping involves intercepting and monitoring electronic communications:

Wiretapping Characteristics:

Electronic interception: Intercepting electronic communications
Physical access: Gaining physical access to communication lines
Legal implications: Often involves legal and privacy issues
Covert operation: Conducted secretly without detection
Recording capability: Can record intercepted communications
Real-time monitoring: Can monitor communications in real-time
Government surveillance: May involve government agencies
Corporate espionage: Used for competitive intelligence

Social Engineering

Social engineering involves manipulating people to reveal confidential information:

Social Engineering Characteristics:

Psychological manipulation: Using psychological tactics to gain information
Trust exploitation: Exploiting trust relationships
Authority impersonation: Pretending to be someone in authority
Urgency creation: Creating false urgency to bypass security
Information gathering: Collecting information from multiple sources
Pretexting: Creating false scenarios to gain information
Human vulnerability: Exploiting human nature and emotions
Multiple techniques: Using various manipulation techniques

Social Engineering Examples

Common Social Engineering Attacks:

Phishing emails: Fake emails requesting sensitive information
Phone scams: Phone calls pretending to be from legitimate organizations
Impersonation: Pretending to be IT support or company executives
Tailgating: Following authorized personnel into secure areas
Pretexting: Creating false scenarios to gain information
Baiting: Leaving infected USB drives or other devices
Quid pro quo: Offering something in exchange for information
Watering hole attacks: Compromising websites frequented by targets

Dumpster Diving

Dumpster diving involves searching through trash to find confidential information:

Dumpster Diving Characteristics:

Physical search: Physically searching through discarded materials
Information recovery: Recovering discarded documents or media
Low-tech attack: Simple but effective information gathering method
Legal gray area: May be legal in some jurisdictions
Corporate espionage: Used for competitive intelligence
Identity theft: Can lead to identity theft and fraud
Password discovery: Finding written passwords or login information
Document analysis: Analyzing discarded business documents

Dumpster Diving Examples

Common Dumpster Diving Targets:

Printed documents: Discarded reports, memos, and correspondence
Computer media: Discarded hard drives, CDs, and USB drives
Password lists: Written passwords and login credentials
Financial records: Bank statements, invoices, and receipts
Personal information: Employee records and personal documents
Technical documentation: System configurations and network diagrams
Customer data: Customer lists and contact information
Organizational charts: Company structure and personnel information

Integrity Concerns

Integrity refers to ensuring that information remains accurate, complete, and unmodified. Various threats can compromise data integrity:

Man-in-the-Middle

Man-in-the-middle attacks involve intercepting and potentially modifying communications between two parties:

Man-in-the-Middle Characteristics:

Communication interception: Intercepting communications between parties
Data modification: Altering data in transit
Transparent operation: Operating without detection by either party
Session hijacking: Taking control of established sessions
Certificate spoofing: Using fake certificates to appear legitimate
Network positioning: Positioning between communicating parties
Real-time modification: Modifying data as it passes through
Multiple attack vectors: Can use various methods to intercept communications

Man-in-the-Middle Examples

Common Man-in-the-Middle Scenarios:

Wi-Fi attacks: Intercepting communications on public Wi-Fi networks
DNS spoofing: Redirecting traffic to malicious servers
ARP spoofing: Intercepting traffic on local networks
SSL stripping: Downgrading HTTPS connections to HTTP
Email interception: Intercepting and modifying email communications
Banking attacks: Intercepting online banking transactions
E-commerce attacks: Intercepting online shopping transactions
VPN attacks: Intercepting VPN communications

Replay Attack

Replay attacks involve capturing and retransmitting valid data transmissions:

Replay Attack Characteristics:

Data capture: Capturing valid data transmissions
Retransmission: Retransmitting captured data at a later time
Authentication bypass: Bypassing authentication mechanisms
Session replay: Replaying entire sessions
Command replay: Replaying specific commands or transactions
Timing manipulation: Controlling when attacks are executed
Network monitoring: Monitoring network traffic for valid transmissions
Automated execution: Can be automated for repeated attacks

Replay Attack Examples

Common Replay Attack Scenarios:

Authentication tokens: Replaying valid authentication tokens
Financial transactions: Replaying valid payment transactions
Access credentials: Replaying valid login credentials
API calls: Replaying valid API requests
Database queries: Replaying valid database operations
Remote commands: Replaying valid remote system commands
Session cookies: Replaying valid session cookies
Digital signatures: Replaying valid digital signatures

Impersonation

Impersonation involves pretending to be someone else to gain unauthorized access:

Impersonation Characteristics:

Identity theft: Stealing someone else's identity
Credential theft: Using stolen credentials to access systems
Authority abuse: Pretending to have authority or privileges
Trust exploitation: Exploiting trust relationships
Social manipulation: Using social engineering techniques
Technical deception: Using technical means to appear legitimate
Multiple identities: Can involve multiple false identities
Persistent attacks: Can be ongoing and persistent

Impersonation Examples

Common Impersonation Scenarios:

Email spoofing: Sending emails from fake addresses
Phone impersonation: Pretending to be someone else on phone calls
Account takeover: Taking control of someone else's accounts
Website spoofing: Creating fake websites that appear legitimate
Social media impersonation: Creating fake social media profiles
Technical support scams: Pretending to be technical support
Executive impersonation: Pretending to be company executives
Government impersonation: Pretending to be government officials

Unauthorized Information Alteration

Unauthorized information alteration involves modifying data without permission:

Unauthorized Alteration Characteristics:

Data modification: Changing data without authorization
File tampering: Modifying files or documents
Database manipulation: Altering database records
Configuration changes: Modifying system configurations
Log tampering: Altering system logs
Code injection: Injecting malicious code into applications
Metadata modification: Changing file metadata or timestamps
Backdoor installation: Installing unauthorized access methods

Unauthorized Alteration Examples

Common Unauthorized Alteration Scenarios:

Financial records: Altering financial data or transactions
Employee records: Modifying employee information
System configurations: Changing system settings
Website content: Defacing or modifying websites
Database records: Altering database information
Log files: Modifying system or security logs
Documentation: Altering technical or business documentation
Software code: Modifying application source code

Availability Concerns

Availability refers to ensuring that information and systems are accessible when needed. Various threats can compromise system availability:

Denial of Service

Denial of Service (DoS) attacks prevent legitimate users from accessing systems or services:

Denial of Service Characteristics:

Service disruption: Disrupting normal service operations
Resource exhaustion: Consuming system resources
Network flooding: Overwhelming network capacity
Application crashes: Causing applications to crash
Distributed attacks: Coordinated attacks from multiple sources
Botnet utilization: Using compromised computers for attacks
Amplification attacks: Using services to amplify attack traffic
Persistence: Can be sustained over long periods

Denial of Service Examples

Common DoS Attack Types:

SYN flood: Overwhelming servers with connection requests
HTTP flood: Sending large numbers of HTTP requests
DNS amplification: Using DNS servers to amplify attack traffic
NTP amplification: Using NTP servers for amplification attacks
Application layer attacks: Targeting specific applications
Bandwidth attacks: Consuming all available bandwidth
Resource exhaustion: Exhausting system resources
Distributed DoS (DDoS): Coordinated attacks from multiple sources

Power Outage

Power outages can cause system unavailability and data loss:

Power Outage Characteristics:

Complete power loss: Total loss of electrical power
Partial power loss: Reduced or unstable power supply
Voltage fluctuations: Variations in voltage levels
Frequency variations: Changes in power frequency
Power surges: Sudden increases in voltage
Power sags: Temporary reductions in voltage
Blackouts: Complete power failures
Brownouts: Reduced voltage levels

Power Outage Examples

Common Power Outage Scenarios:

Natural disasters: Hurricanes, earthquakes, and severe weather
Equipment failures: Power grid equipment malfunctions
Maintenance activities: Planned power outages for maintenance
Overload conditions: Power grid overloads
Accidents: Vehicle accidents damaging power infrastructure
Vandalism: Intentional damage to power equipment
Cyber attacks: Cyber attacks on power infrastructure
Fuel shortages: Shortages of fuel for power generation

Hardware Failure

Hardware failures can cause system unavailability and data loss:

Hardware Failure Characteristics:

Component failure: Failure of individual hardware components
Mechanical failure: Physical damage to hardware components
Electrical failure: Electrical problems in hardware
Heat damage: Damage from excessive heat
Wear and tear: Gradual degradation over time
Manufacturing defects: Defects in hardware manufacturing
Environmental factors: Damage from environmental conditions
Age-related failure: Failures due to component aging

Hardware Failure Examples

Common Hardware Failure Scenarios:

Hard drive failure: Mechanical or electronic hard drive failures
Memory failure: RAM or other memory component failures
CPU failure: Processor failures or overheating
Power supply failure: Power supply unit failures
Motherboard failure: Main circuit board failures
Network card failure: Network interface failures
Cooling system failure: Fan or cooling system failures
Storage controller failure: Storage controller malfunctions

Destruction

Destruction involves physical damage to systems and data:

Destruction Characteristics:

Physical damage: Physical destruction of hardware
Data destruction: Permanent loss of data
Intentional damage: Deliberate destruction of systems
Accidental damage: Unintentional destruction
Natural disasters: Destruction from natural events
Fire damage: Damage from fires
Water damage: Damage from water or flooding
Vandalism: Intentional damage by vandals

Destruction Examples

Common Destruction Scenarios:

Fire damage: Building fires destroying computer equipment
Flood damage: Water damage from floods or leaks
Earthquake damage: Structural damage from earthquakes
Hurricane damage: Wind and water damage from hurricanes
Vandalism: Intentional damage to computer systems
Accidents: Accidental damage to equipment
Theft: Stealing and potentially destroying equipment
Sabotage: Deliberate destruction by insiders

Service Outage

Service outages involve the unavailability of services or applications:

Service Outage Characteristics:

Application unavailability: Applications becoming unavailable
Network connectivity issues: Network connection problems
Server failures: Server systems becoming unavailable
Database unavailability: Database systems going offline
Web service failures: Web services becoming unavailable
Cloud service outages: Cloud-based services going offline
Third-party dependencies: Failures in external services
Maintenance windows: Planned service maintenance

Service Outage Examples

Common Service Outage Scenarios:

Web server crashes: Web servers becoming unavailable
Database failures: Database systems going offline
Network failures: Network connectivity issues
DNS failures: Domain name system failures
Email server outages: Email services becoming unavailable
Cloud service outages: Cloud providers experiencing outages
CDN failures: Content delivery network failures
API service failures: Application programming interface failures

Protection Strategies

Confidentiality Protection

Confidentiality Protection Measures:

Encryption: Encrypting data at rest and in transit
Access controls: Implementing proper access controls
Authentication: Strong authentication mechanisms
Network security: Securing network communications
Physical security: Protecting physical access to systems
Employee training: Training employees on security awareness
Data classification: Classifying and protecting sensitive data
Secure disposal: Proper disposal of sensitive materials

Integrity Protection

Integrity Protection Measures:

Digital signatures: Using digital signatures for data integrity
Checksums: Using checksums to verify data integrity
Access controls: Implementing proper access controls
Audit logging: Logging all data modifications
Version control: Maintaining version control of data
Backup and recovery: Regular backups and recovery procedures
Network security: Securing network communications
Input validation: Validating all input data

Availability Protection

Availability Protection Measures:

Redundancy: Implementing redundant systems and components
Backup power: Uninterruptible power supplies and generators
Load balancing: Distributing load across multiple systems
Failover systems: Automatic failover to backup systems
Monitoring: Continuous monitoring of system health
Preventive maintenance: Regular maintenance of systems
Disaster recovery: Comprehensive disaster recovery plans
Security measures: Protecting against DoS attacks

Exam Preparation Tips

Key Concepts to Master

Confidentiality concerns: Understand snooping, eavesdropping, wiretapping, social engineering, and dumpster diving
Integrity concerns: Know man-in-the-middle, replay attacks, impersonation, and unauthorized information alteration
Availability concerns: Understand denial of service, power outages, hardware failures, destruction, and service outages
CIA Triad: Know the three fundamental principles of information security
Threat identification: Be able to identify different types of security threats
Protection strategies: Understand how to protect against different types of threats
Real-world examples: Know common scenarios for each type of threat
Security awareness: Understand the importance of security awareness

Study Strategies

Effective Study Approaches:

Understand the CIA Triad: Learn how confidentiality, integrity, and availability work together
Study real-world examples: Learn about actual security incidents and attacks
Practice threat identification: Practice identifying different types of threats
Learn protection measures: Understand how to protect against different threats
Stay current: Keep up with current security threats and trends
Understand impact: Learn about the potential impact of security threats

Practice Questions

Sample Exam Questions:

What is the primary goal of a confidentiality attack?
What type of attack involves intercepting and modifying communications between two parties?
What is the main purpose of a denial of service attack?
What type of social engineering attack involves searching through trash for information?
What is the primary concern of data integrity?
What type of attack involves capturing and retransmitting valid data transmissions?
What is the main goal of an availability attack?
What type of attack involves pretending to be someone else to gain access?
What is the primary concern of data confidentiality?
What type of attack involves secretly listening to conversations?

FC0-U61 Success Tip: Understanding confidentiality, integrity, and availability concerns is essential for IT security awareness and protection. Focus on learning the three pillars of the CIA Triad and their associated threats. Pay special attention to confidentiality threats (snooping, eavesdropping, wiretapping, social engineering, dumpster diving), integrity threats (man-in-the-middle, replay attack, impersonation, unauthorized information alteration), and availability threats (denial of service, power outage, hardware failure, destruction, service outage). Understanding these concepts and their real-world examples will help you identify security threats and implement appropriate protection measures. This knowledge is crucial for anyone working in IT and is fundamental to information security.

Previous: Objective 5.3 Summarize Methods Interface Databases

Next: Objective 6.2 Explain Methods Secure Devices Best Practices