(upbeat music)
- [Lisa] One of the basic principles
of providing a secure system,
is to manage risk and protect sensitive information.
The goal is to keep data private, unchanged, and available.
The concept is also called the CIA triad,
a widely recognized information assurance model.
CIA stands for confidentiality, integrity and availability.
Private information can include
personally identifiable information.
Which is something that could identify someone,
and include Social Security, credit card,
or bank account numbers.
It can also include business information
such as data, employee records, and trade secrets.
Keeping data secure is very challenging
in today's digital world.
Where nearly everyone including companies,
social media, hospitals and many others
collect, store, and share our information.
Confidentiality is the promise
of keeping private information private,
by preventing unauthorized access.
An example of a violation of confidentiality
would be if someone, other than your doctor's office,
gaining access to patient records
and reading your medical file about your health issues.
Integrity is protecting data from unauthorized changes.
Data integrity can be compromised
when information has been altered or destroyed.
Either maliciously or accidentally.
An example of a violation of integrity
would be a student going into the grade book
and changing his or her algebra grade from a C to an A.
Availability is ensuring data and services
are available only to authorized users when needed.
When authorized users need access to data,
they should be able to reach the data.
One threat against availability
is a distributed denial-of-service attack or DDoS,
which is an effort to interrupt
or suspend services to legitimate users.
A DDoS will use armies or botnets
which lie in wait at a predefined time
and we'll launch an attack by sending multiple requests
to a system, and lock out legitimate users.
To protect data, it's important to provide access
to private data only to authorized individuals.
Make sure everyone and everything who accesses data
should verify their identity in some way.
Methods include, a password or PIN,
a smart card or a fingerprint.
Businesses and organizations control access
to digital data, by assigning permissions
which allows access to the company data
only to authorized users, and no one else.
We also use encryption which scrambles and conceals the data
in a format where the only way you can see the data
is if you have a key.
To protect against a violation of integrity
or unauthorized changes, there are a few guidelines.
Businesses and organizations should use
specialized software that monitors,
for unusual or suspicious activity
and notify someone if there are unauthorized
changes to the data.
You'll also want to keep systems current
and upgrade when necessary.
Businesses should back up systems regularly
and store in an offsite location.
And at home, you should make sure you have a way
to back up your own personal data as well.
I'm at this website where we can see a digital attack map
showing top daily distributed
denial-of-service attacks worldwide.
We know there are threats to our privacy and security
but as you can see, there are many ways
to provide confidentiality, integrity
and availability to protect your data.
(upbeat music)