Fundamentals of IT Security: The CIA Triad

Introduction

• The CIA Triad is a fundamental concept in IT security.
• CIA stands for Confidentiality, Integrity, and Availability.
• Sometimes referred to as AIC to avoid confusion with the U.S. Central Intelligence Agency.
• The CIA Triad forms a triangle, with each leg representing one of the security objectives.

Confidentiality

• Objective: Prevent unauthorized access to private information.
• Methods to Ensure Confidentiality:
  • Encryption:
    • Data is encrypted before being sent and decrypted by the recipient.
    • Prevents unauthorized individuals from understanding the data if intercepted.
  • Access Controls:
    • Limit access to information based on roles and permissions.
    • Example: Marketing personnel can access marketing data but not accounting information.
  • Authentication:
    • Use of additional authentication factors (e.g., two-factor authentication) enhances confidentiality.

Integrity

• Objective: Ensure data received is exactly the same as the data sent.
• Methods to Ensure Integrity:
  • Hashing:
    • Sender creates a hash of the data; both data and hash are sent to the recipient.
    • Recipient verifies integrity by comparing the received hash with their own computed hash.
  • Digital Signatures:
    • A hash encrypted with an asymmetric encryption algorithm.
    • Confirms that data has not changed and verifies the sender's identity.
  • Certificates:
    • Used to identify devices or people, ensuring data integrity during transfers.
  • Non-repudiation:
    • Provides proof that the received data truly came from the sender.

Availability

• Objective: Ensure systems are accessible and operational when needed.
• Methods to Ensure Availability:
  • System Design:
    • Systems should be designed for high availability and fault tolerance.
    • Use of redundant components ensures continued operation if one fails.
  • System Maintenance:
    • Regular management and updates, including patching, are necessary to maintain stability.
    • Patching helps close security vulnerabilities and prevent exploits.

Conclusion

• The CIA Triad is essential for understanding and implementing IT security.
• Each component of the triad plays a critical role in protecting information and systems.