CIA Triad of Information Security

What is CIA Triad?

CIA stands for Confidentiality, Integrity, and Availability and they are the key attributes of information security that are used as a security benchmark model to evaluate information security of an organization. It is a widely used model to guide an organization to implement policies and mechanisms aimed at keeping their data secure. 

Confidentiality

Confidentiality means keeping the systems, data, and other technological assets confidential from unauthorized access. In the modern world, it is very important to keep private and sensitive data from unauthorized access. Confidentiality can be achieved by using mechanisms like authentication, authorization, and encryption. Authentication is allowing only authorized users to access the systems and data. It includes using passwords, biometrics, and security tokens to establish identity. Authorization is giving different user permission levels to access resources. Authentication validates the identity of users while authorization defines if that user has access to a specific resource. Both authentication and authorization are needed to ensure confidentiality. Encryption is the process of converting data into cipher in order to prevent the exposure of confidential data to unauthorized parties. There are two types of encryption mechanisms Symmetric Encryption and Asymmetric Encryption. Packet sniffing, keylogging, and phishing are some of the attacks that affect confidentiality. 

Integrity 

Integrity is preventing the malicious alteration of data by unauthorized parties. It is the accuracy and completeness of data. Information should not be changed during transit. This simply means that the receiver should get the exactly same message that is sent by the sender. Techniques like hashing and encryption can be used to ensure the integrity of data. Hashing is a mathematical algorithm used to generate signatures. Different hashing algorithms like MD5 and SHA(Secure Hashing Algorithm) can be used to ensure the integrity of data. Man in the middle attacks and session hijacking are some of the attacks that affect integrity. 

Availability

Availability is the process of ensuring that the data, information, and systems are available when it's needed. Backups, hardware maintenance, software patching, and redundancy are mechanisms to ensure availability. Redundancy results in fault tolerance. One example of lack of availability is not having any kind of backups for the systems. In case of a cyber-attack if all the data from the systems are deleted then without backups it is impossible to recover. Therefore a routine backup is needed to ensure high availability. Denial of Service (DOS) attack is a type of attack where the hackers try to make the systems unavailable to intended users. This is a good example of a cyber threat which results in a loss of availability. 

Confidentiality, Integrity, and Availability are the three pillars of information security. Any cyber-attack will compromise any of these attributes. Therefore strong security policies and mechanisms should be implemented in an organization to ensure information security. CIA triad is an important model that can be used to implement the information security strategy of an organization.

REFERENCES

https://www.techopedia.com/definition/25830/cia-triad-of-information-security
https://www.icann.org/news/blog/what-is-authorization-and-access-control
https://www.forcepoint.com/cyber-edu/cia-triad
https://www.csoonline.com/article/3519908/the-cia-triad-definition-components-and-examples.html
https://blog.jamestyson.co.uk/the-cia-and-dad-triads