Blue Teamers often go through cyber security concepts to refresh their skills and stay relevant in their field. The basic concepts include understanding the CIA triad, OSI top 7 layers, cyber kill chain, OWASP top 10 vulnerabilities, etc. These concepts stand in front of any level of experienced analyst. In this article, we will learn about the CIA triad, which forms an integral part of cyber security concepts.
The CIA Triad (abbreviation: Confidentiality, Integrity, and Availability) is a model that forms the basis for cyber security. It is a must for implementation across organizations at any level. Confidentiality in general keeps the information safe by limiting access. Integrity refers to data that ensures that data is not tampered with so that the data that is being accessed is accurate. Availability refers to the data that should be available for all authorized parties at any time. Let’s explore each of these terms in detail:
Confidentiality:
Let’s say a user has approached a bank for a debit or credit card. The user has to withdraw cash via ATM by providing a 4-digit PIN to verify his or her authenticity. As soon as the user enters the pin, the ATM verifies the pin to delegate access to the user’s account. Now the bank has to ensure that the PIN is not disclosed to the outside world so that the account information is kept confidential only for authorized users.
In the above example, it is clear that confidentiality is about keeping personally identifiable information safe, and it must be kept confidential from unauthorized personnel. Organizations must consider keeping their employee’s or client’s information safe and confidential, which instills confidence.
Integrity:
Let’s take the above example. As the user enters the pin, the pin is verified by the ATM with its server to verify its legitimacy. Now, let’s say the attacker has access to the ATM server that has the PIN of all clients. If the attacker can change the PIN of all users of the bank, then it is obvious that any user who enters the PIN might get an error as the data has been tampered with.
As discussed, it is prudent that the available information has been modified, so the users are unable to access their accounts at the ATM. So organizations must ensure that the information is trustworthy and should not be tampered with.
Availability:
In the previous example, as stated above, the banks should ensure that ATMs are available across countries so that users can access the information and that it is readily available to all users across geographies. It ensures that information is readily available and accessible across countries. Organizations must ensure that they maintain hardware and infrastructure that can provide or display the information.
As discussed in the above example, availability means holding and making the information readily available to all the users or clients. It ensures maintaining the software, physical hardware, websites, etc. regularly so that customers can access their information without any hassle.
Conclusion:
In this article, we have discussed the CIA triad and each of the terms in detail. All three terms—confidentiality, integrity, and availability—go hand in hand and must be implemented in cohesion. For example, let’s say a hacker gets access to a bank ATM server through unauthorized access. As soon as the hacker gets access, he or she changes or tampers with the ATM pins of all servers. As soon as the PIN is tampered with, users across geographies will not be able to access the ATM to withdraw their money. Let’s discuss the key takeaways in the above example.
- In the above example, confidentiality must be strictly implemented to prevent unauthorized access.
- To ensure integrity, the PIN must be hashed and salted to prevent tampering with data.
- The banks must ensure to keep a secondary server in case the primary server is down. In this case, if the secondary server is available, we can ensure availability even if it is known that the primary server is down.
Organizations can also avail services from third-party service providers to ensure that their information or data follows or adheres to the CIA triad. Third-party vendors always ensure that their client’s data adheres to the CIA triad, keeps information safe, and is readily available, allowing organizations to focus on their business without worrying about their data privacy.
