A technician captures traffic on a switch mirror port and finds that user login credentials for an internal web application are travelling in readable cleartext over HTTP, so anyone with packet-capture access can read them. Which element of the CIA triad is most directly compromised by this finding?
- AIntegrity, because an attacker who reads the credentials could later modify the account, so the trustworthiness of the stored data is the main loss.
- BAvailability, because exposing the login could lead to the account being locked out and the legitimate user then denied access to the application.
- CConfidentiality, because the credentials can be read by an unauthorised party who captures the packets, defeating the aim of keeping data secret in transit. Correct
- DNon-repudiation, because cleartext credentials would make it impossible to prove who carried out a given action later on.
Why A is wrong: Integrity concerns unauthorised alteration of data; capturing readable credentials exposes them but does not change any stored value, so this is not the principle harmed here.
Why B is wrong: Availability is about authorised users reaching a service; the web application stays reachable and no disruption has occurred, so availability is not what the cleartext exposure breaks.
Why C is correct: Confidentiality is the assurance that data is disclosed to authorised parties alone; cleartext credentials on the wire can be read by anyone capturing packets, which is precisely this loss.
Why D is wrong: Non-repudiation is the inability to deny an action and is not one of the three CIA-triad pillars, so it cannot be the triad element compromised by packet exposure.