Which component of the IT Security Model is attacked with eavesdropping and interception?

In information security models, confidentiality ensures that sensitive data is accessible exclusively to authorized individuals, entities, or automated processes, thereby preventing unauthorized disclosure. Passive attacks such as eavesdropping, wiretapping, and packet interception directly target this principle by observing, listening to, or capturing unencrypted communications across network channels without altering the underlying data. In Industrial Control Systems (ICS), unauthorized interception of telemetry or control commands violates confidentiality by exposing proprietary operational protocols, system states, and credentials to threat actors. Conversely, integrity focuses on preventing unauthorized data alteration, availability guarantees continuous operational access to critical infrastructure assets, and authentication confirms identity validity.

B. Availability: Availability ensures systems and data are accessible to authorized users when needed; passive eavesdropping does not disrupt access or cause denial of service.
C. Integrity: Integrity guarantees that data remains accurate and unaltered; eavesdropping involves passive observation without modifying or corrupting the transmitted data payload.
D. Authentication: Authentication verifies the claimed identity of users or system components, whereas eavesdropping focuses on illicitly capturing transmitted data content during communication.

NIST Special Publication 800-82 Revision 2, Guide to Industrial Control Systems (ICS) Security, Section 3.1, "IT vs. ICS Security Objectives," pp. 3-1 – 3-3. https://doi.org/10.6028/NIST.SP.800-82r2

NIST Special Publication 800-33, Underlying Technical Models for Information Technology Security, Section 2.1, "Security Services," p. 4. https://doi.org/10.6028/NIST.SP.800-33