CIA Triad - Confidentiality, Integrity, and Availability Flashcards
Confidentiality
seeks to prevent the unauthorized disclosure of information
Integrity
seeks to prevent unauthorized modification of information
Availability
ensure authorized people can access the data they need, when they need to.
CIA Triad OR (AIC)
Confidentiality, Integrity, Availability
Availability - Threats
Malicious attacks (DDOS, physical, system compromise, staff) Application failures (error in the code) Component failure (hardware)
Availability - Defense
IPS/IDS
Patch Management
Redundancy on hardware power (Multiple power/supplies/UPS’/generators Disks (RAID), Traffic paths (network design), HVAC, staff, HA (high availability)
SLAs - How high uptime we want (99.%9) - ROI
Confidentiality
it keeps data secrets
Integrity
Seeks to ensure data that is written in an authorized manner is complete and accurate
Subject
An active entity on an information system
Object
a passive data file
Annualized Loss Expectancy
the cost of lose due to a risk over a year
Threat
a potentially negative occurrence
Vulnerability
a weakness in a system
Risk
a matched threat and vulnerability
Safeguard
a measure taken to reduce risk
Confidentially – EXAMPLE
A confidentially attack would be the theft of Personally Identifiable Information (PII), such as credit card information
Data Integrity
seeks to protect information against unauthorized modification
System Integrity
seeks to protect a system
System Integrity - threat
If a user installs malicious software on the system to allow future “back door” access, they have violated the systems integrity
Data Integrity - threat
If an unethical student compromises a college grade database to raise their grades, they have violated the data integrity
What does the acronym DAD stand for?
Disclosure, Alteration, Destruction
Disclosure
Unauthorized release of information
What does Alteration mean?
the unauthorized modification of data
Authorization - Actions
Actions may include reading, writing, or executing files or programs.
What does Destruction reference/mean in security?
making a system or data unavailable
Identity and Authentication
Proving an identity claim is called authentication; to authenticate the identity claim, usually by supplying a piece of information or an object that only an individual possess.
What does Authorization mean in security?
the actions you can perform on a system once you have been identified and authenticated.
