Confidentiality, integrity, and availability are all really important, but there's also these concepts too: 

• Identification

  • Identification is not the same as authentication.  This is just to identify you - things like a username, but not the password.​​​

• Authentication

  • Authentication is when you enter the password (that only you should know) to verify your username or identification​.

• Authorization

  • After authentication, authorization is what will allow you access to just the objects you need to do your job - nothing less, nothing more.  Need-to-know and least privilege are concepts that belong in authorization. ​

• Logging and Auditing

  • Without logging and auditing, there would be no point of authorization or authentication.  We need proper logging and auditing techniques in order to track user or system action for compliance or general investigative requirements.​

• Accountability

  • Accountability occurs as a result of proper logging and auditing controls.  Accountability makes sure that users performing illegal actions are held responsible, or at least properly identified.​

• Nonrepudiation

  • Nonrepudiation is a great concept.  If someone does something malicious on a system, nonrepudiation controls makes sure that person cannot deny it was them who performed the malicious action.  It is a way to undeniably verify the sender of a message, or the action of a subject.  ​

​