The idea
DAD is a way to look at the adverse outcomes that oppose the CIA Triad:
- Disclosure undermines confidentiality: information reaches someone who is not authorised to see it.
- Alteration undermines integrity: information is changed improperly.
- Destruction undermines availability: information or systems become unusable.
The final D is also described as denial in some explanations. Availability can be lost without data being destroyed.
A simple example
In a fictional document service, a leaked file is disclosure, an unauthorised edit is alteration, and deletion without a recoverable copy is destruction.
Why it matters
Thinking about the consequence helps connect a threat to an appropriate control. Ask what could be exposed, changed or made unavailable, then consider prevention, detection and recovery.
Further reading
GDS guidance on threat modelling connects security objectives to the outcomes of threats.