When you think cyber security, you should think CIA.
No, not those spy guys.
A different kind of CIA.
What I mean is confidentiality, integrity, and availability.
These three things make up something that we call the CIA triad.
And let's talk about those ideas in a little more detail.
So first of all, confidentiality.
That's the idea that says only an authorized user should be able to see particular information or access particular resources.
So in order to do that, let's take an example
where we've got let's say this guy is an authorized user and he wants to be able to read this particular data.
So what would we do?
Well, we'd probably put in place some sort of security system,
some sort of authentication authorization, multifactor authentication, some sort of encryption capability,
so that when he goes to access this, he is given access and gets it.
But on the other hand, if we have an unauthorized user
who wants to do the same thing, they try to get into the system and they are blocked.
So that's really what confidentiality is about.
It's a very simple concept.
It's a lot harder to implement.
A lot of times if you look at the literature, it will refer to confidentiality as the same as privacy.
But I'll say that's kind of based on an older notion of what privacy is.
Now we have a more modern notion that says confidentiality really involves more things
like notice and consent and the right to be forgotten and things like that.
That's not really covered in this overall notion of confidentiality, but it is still very important.
So confidentiality, the first of the CIA Triad.
How about next?
Integrity.
Well, integrity basically means that if I place an order for, let's say, 100 widgets,
if someone can't come along later and turn that into 100,000 widgets or a million
or change the number entirely, or delete the record entirely.
In other words, the information is trustworthy.
It is true to itself is another way to think of it.
So with integrity technologies, what we do is we're looking for tampering
and we're detecting that and then alerting someone so that they know that this data is no longer trustworthy.
A bad guy, for instance, might try to come into a system after he's hacked it
and change the log file to remove any record that he was there in the first place.
That would be an integrity attack.
So we need security capabilities to ensure that the system is still true to itself.
And then the last part of the CIA triad is availability.
In this case, it's about making sure that authorized users have access to the resources that they need when they need them.
So, for instance, we have authorized user here and they want to access a particular server.
So when they come, they get access as they expect.
However, we could end up with a case where we have a malicious actor
who comes in and floods this system with too much traffic, therefore taking it down, making it not available.
We refer to this as a denial of service attack, and a denial of service attack can take a lot of different forms.
But that's the basic idea, is that a bad guy is preventing a good guy from getting access to the system.
So when it comes down to security, again, think CIA, not the spy guys, but the CIA triad and use that as a checklist.
Whenever you come up with a new security project,
go back over the the different angles of the CIA triad and say, did I cover confidentiality?
Did I cover integrity attacks?
Did I cover availability? and If I've got all of those things covered, then it's job finished.