Overview
This lecture introduces the CIA Triad, the foundational model for IT security, explaining its three core principles: Confidentiality, Integrity, and Availability.
The CIA Triad Overview
- The CIA Triad stands for Confidentiality, Integrity, and Availability, forming the basis of IT security.
- Sometimes called the AIC Triad to avoid confusion with the U.S. Central Intelligence Agency.
- The triad is often depicted as a triangle with each point representing one of the principles.
Confidentiality
- Confidentiality ensures that private information is accessible only to authorized individuals.
- Encryption protects data by converting it to unreadable code for unauthorized users.
- Access controls restrict information based on user permissions (e.g., marketing staff can’t access accounting data).
- Multi-factor authentication increases confidentiality by requiring multiple credentials for access.
Integrity
- Integrity means data is accurate, complete, and unaltered during transfer or storage.
- Hashing lets a sender and receiver compare data fingerprints to detect changes.
- Digital signatures encrypt hashed data, verifying both authenticity and integrity.
- Certificates provide identity assurance for devices and users.
- Non-repudiation guarantees proof of data origin and delivery, preventing denial of sending or receiving.
Availability
- Availability ensures systems and data are accessible when needed.
- Fault tolerance allows redundant components to maintain services during failures.
- Regular system management and patching keep systems stable and close security vulnerabilities.
Key Terms & Definitions
- Confidentiality — Protecting information from unauthorized access.
- Integrity — Ensuring information remains accurate and unaltered.
- Availability — Ensuring information and systems are accessible when needed.
- Encryption — Encoding information so only authorized users can access it.
- Access Controls — Mechanisms to limit information access to authorized users.
- Hashing — Creating a unique fingerprint for data to verify integrity.
- Digital Signature — An encrypted hash to confirm data origin and authenticity.
- Certificates — Digital proofs of identity used for securing communications.
- Non-repudiation — Assurance that the sender and recipient cannot deny their actions.
Action Items / Next Steps
- Review the definitions and examples of each component of the CIA Triad.
- Practice identifying real-world situations where confidentiality, integrity, or availability are critical.
- Ensure understanding of terms for upcoming quizzes or exams.