The CIA Triad - Confidentiality, Integrity, and Availability

In this tutorial you are going to lean about The CIA Triad - Confidentiality, Integrity, and Availability.

Introduction to CIA Triad

The CIA triad is a widely used information security model that can guide an organization's efforts and policies aimed at keeping its data secure. The model has nothing to do with the U.S. Central Intelligence Agency.

Confidentiality

Only the authorized individuals/systems can view sensitive or classified information.
The data being sent over the network should not be accessed by unauthorized individuals. The attacker may try to capture the data using different tools available on the Internet and gain access to your information.
A primary way to avoid this is to use encryption techniques to safeguard your data so that even if the attacker gains access to your data, he/she will not be able to decrypt it.
Encryption standards include AES (Advanced Encryption Standard) and DES (Data Encryption Standard).
Another way to protect your data is through a VPN tunnel. VPN stands for Virtual Private Network and helps the data to move securely over the network.

Confidentiality refers to the protection of sensitive information from unauthorized disclosure. This includes both preventing unauthorized access to sensitive data, as well as ensuring that any access that does occur is properly controlled and logged. To achieve confidentiality, organizations often use technologies such as encryption, access controls, and firewalls.

Integrity

Primarily concerned with the accidental damage of data.
Prevention of unauthorized modification of information assets.
Integrity deals with preventing, or at least detecting, unauthorized “writing”.
Data must not be changed in transit, and steps must be taken to ensure that data cannot be altered by unauthorized people (for example, in a breach of confidentiality).

Integrity refers to the protection of data from unauthorized modification or destruction. This includes both preventing unauthorized changes to data, as well as detecting and responding to any changes that do occur. To achieve integrity, organizations often use technologies such as data hashing, intrusion detection systems, and security information and event management (SIEM) systems.

Availability

It means network should be readily available for all its users.
To ensure availability, network administrator should maintain hardware and make regular updates.
Attacks such as DoS or DDoS may result into a network unavailability.

Availability refers to ensuring that authorized users have access to the data and systems they need, when they need it. This includes both preventing disruptions to normal system operation, as well as quickly restoring systems and data in the event of a disruption. To achieve availability, organizations often use technologies such as load balancers, redundant systems, and disaster recovery plans.

Thumb Rule of CIA Triad

Protect- Confidentiality
Preserve-Integrity
Promote-Availability

History of CIA Triad

It emerged over time as an article for wisdom among information security pros.
The concept of confidentiality was first formalized in a 1976 U.S. Air force study.
The concept of integrity was introduced in a 1986 research paper.
The concept of Availability came in when a malware Morris worm had knocked down a significant portion of embryonic internet offline.

Importance of CIA Triad

Understand the bewildering array of security softwares, services and techniques.
Enables the team to make productive decisions about which of the three elements is more important for a specific set of data and organization.
Enables our data to be protected from any outside attacks.
Helps to access our data in a secure way.

CIA Triad Examples

In an ATM Machine the CIA Triad provides confidentiality by requiring two-factor authentication i.e. a physical card and a pin code before allowing access to data.

It uses the concept of integrity by ensuring that any transfer or withdrawals made through the machine are reflected in the accounting for the user’s bank account.

It provides availability because it’s in a public place and is accessible even when the bank branch is closed.

Conclusion

The CIA Triad is not just a concept but it is widely used in security frameworks, and regulations. It's considered to be the foundation of an organization's security and is used to identify and prioritize the assets that need to be protected, determine the vulnerabilities and threats that can be used to exploit them, and then select and implement the appropriate countermeasures. Many compliance standards such as ISO 27001, SOC2, HIPAA, and PCI-DSS have provisions for the protection of CIA.

Implementing the CIA Triad can be a complex and ongoing process, involving ongoing monitoring and management of security controls and regular testing to ensure that the controls are working as intended. It requires not only the right technology but also the right people, processes, and policies in place. It's important to have a clear understanding of the organization's business goals and how they align with the CIA Triad objectives, and plan accordingly.

In summary, the CIA Triad is a security model that describes the three fundamental security goals of any organization: confidentiality, integrity, and availability. It's used to identify and prioritize the assets that need to be protected, determine the vulnerabilities and threats that can be used to exploit them, and then select and implement the appropriate countermeasures. It's a widely used concept in security frameworks, and regulations and it's considered as the foundation of an organization's security.

This post is contributed by Divyanshu Shekhar (BTech CS, Chandigarh Engineering College). If you like TheCode11, then do follow us on Facebook, Twitter and Instagram.