Security must start somewhere. This somewhere is a list of security principles. Confidentiality, Integrity, and Availability are considered the primary goals and objectives of a security infrastructure.
Controls are measured on how well they address those core principles. How important each principle is to an organization depends on the security goals and requirements of a company.
Confidentiality protects the secrecy of data, objects, or resources. The goal of emphasizing this principle is to prevent or minimize unauthorized access to data. Authorized users can access or interact with objects while confidentiality actively prevents unauthorized users from doing so. Many security measures or controls support Confidentiality.
Example Technical and Organizational Measures (TOM) to support Confidentiality are encryption, access control, authentication, data classification, and training of personnel
An object is the passive part in a security relationship, such as files, applications, computers, and network connections. A subject is the active part in a security relationship, such as users, programs or computers. Access control is the management of the relationship between object and subject.
For confidentiality to be maintained in a network, data needs to be protected from unauthorized access and disclosure while in transit, in program, and in storage. Specific controls are required for each of these states of data, resources, and objects to maintain confidentiality.
Numerous attacks focus on the violation of confidentiality. Examples are capturing network traffic, stealing passwords, port scanning, privilege escalation, and social engineering.
Violation of confidentiality (disclosure) is not limited to intentional attacks. Many times the cause for unauthorized disclosure are the result of human error and oversight. Events leading to disclosure include failing to encrypt a transmission, accessing malicious code, walking away from a computer while sensitive data is displayed on the screen, misconfigured security control, or oversight in a security policy.
Confidentiality and Integrity are depending on each other. Without object integrity, confidentiality cannot be maintained. Integrity means the inability of an object to be modified without permission.
Confidentiality concepts, conditions, and aspects include:
Sensitivity refers to the damage caused by the disclosure of data
Criticality defines how important an object is for the functionality of an organization
Secrecy describes the act of preventing disclosure
Privacy refers to keeping personally identifiable data confidential
Organizations need to evaluate the level of confidentiality they wish to enforce on objects.
Integrity is the concept of protecting the reliability and correctness of data. Integrity protection prevents unauthorized changes to data. It ensures that data remains correct, unaltered, and preserved. Well implemented integrity provides the functionality of authenticated change while it prevents intended and malicious unauthorized activities as well as mistakes by authorized users.
Objects must retain their correctness and can only be intentionally changed by authenticated users, in order to maintain integrity. Integrity mechanism and protection provide a high level of assurance that the data, object, and resources are unaltered from their original protected state.
Unauthorized and unwanted changes should not occur while an object is in storage, in transit, or in process.
Integrity is checked from three perspectives:
- Preventing unauthorized subjects from making modifications
- Preventing authorized subjects from making unauthorized changes (mistakes)
- Maintaining consistency of objects so that their data is correct
In order to maintain integrity on a system, controls must be in place to restrict access to data, objects, and resources. Activity logging must be employed to verify that only authorized users are able to access their respective resources
Examples attacks against or violations of integrity are viruses, coding errors, malicious modifications, and backdoors.
As in confidentiality, the attacks on integrity are not always intentional. Human errors, lack of oversight, or improperness can cause unauthorized alteration of information.
There are many countermeasures to support the integrity approach in security. Access control, authentication, intrusion detection, encryption, hashing, interface restrictions, input verification, training of personnel. Integrity is depending on confidentiality and vice versa.
Integrity concepts, conditions, and aspects
Accuracy is correct and precise
Truthfulness is a true reflection of reality
Authenticity refers to genuine and authentic
Accountability means being responsible for actions and results
Responsibility refers to being in charge of having control over a subject or object
Comprehensiveness the complete scope of all elements
Nonrepudiation is not being able to deny having performed an activity or action
Validity is factual and logically correct
The last principle of the triad is availability. It refers to authorized subjects having timely and uninterrupted access to objects. Availability implies that infrastructure, like network services or authentication systems, is functional and allows authenticated users to gain authorized access.
For availability to be maintained, controls need to be in place to ensure an acceptable level of performance, to handle interruption, to be redundant, to maintain functional backups, and to prevent data loss.
Example threats to availability are device failure, environmental issues, software and hardware errors, DDoS (Distributed Denial of Service) attacks, and communication interruptions. As with confidentiality and integrity, violations of availability are not limited to intentional attacks.
Examples are overutilizing hardware or software component, mislabeling or incorrectly classifying objects, or accidentally deleting files.
Countermeasures to support availability are numerous and include monitoring of performance, monitoring of network traffic, monitoring of network bandwidth, redundancy for critical systems, maintaining and testing backup systems, (D)DoS protection systems, designing fault-tolerant systems, testing access control systems, removing single points of failure, and business continuity planning.
Availability depends on confidentiality and integrity and cannot be maintained without the two.
Availability concepts and aspects:
Usability refers to easy to learn, understand, control, and apply
Accessibility is the concept of a wide range of subjects can interact with an object
Timeliness means to provide low latency response or being within a reasonable timeframe.
Every organization has unique security requirements. Knowing which assets are more important than others guides the development of a dedicated security posture and the deployment of security solutions.
Prioritizing with the CIA Triad is a good start and can be replicated for design, architecture, deployment, maintenance, and development. The prioritization focuses the efforts of an organization on one aspect over the other. It doesn’t mean that the second or third prioritised items are ignored or improperly addressed. Each organization decides its dedicated security priorities.