• Core framework for information security

• Three essential pillars:

  • Confidentiality

  • Integrity

  • Availability

• Guides organizational security policies and practices

​CIA TRIAD

• Restricts access to authorized users only

• Protected through:

  • Authentication systems (MFA)

  • Encryption methods

  • Access permissions (Least Privledge)

• MFA: What you have, what you know, what you are

• Businesses use labeling like privileged, top-secret, internal use only

​

​Confidentiality

-Ensures that data remains accurate and unaltered during storage or transfer.
-Can be maintained through auditing and encryption.
-Digital signatures and headers are used to ensure integrity

​

​Integrity

-Data is available when needed
-Possible threats
-Cyber Attacks
-Natural Disasters
-Hardware Failure
-Techniques: Redundancy, fault tolerance, backups

​Availability

Repudiation: Rejection of an event of idea

Non-repudiation: to prove that someone did something even if they say they didn't

-Authenticaton
-Logging
-Security cameras

​Non-repudiation

• Any potential danger to information or systems

• Examples: Malware, phishing, insider threats

​Threats

• Any potential danger to information or systems

• Examples: Malware, phishing, insider threats, 0 day attacks

​

​Vulnerability

• Likelihood that a threat will exploit a vulnerability

• Risk = Threat × Vulnerability × Impact

• Register can include category, probability, impact, threshold, cost,

  and contingency plan

• Risk includes cost, scope and time

• Contingency plans in case of reality

​

​Risk

• Limiting user access to only what is necessary

• Reduces risk and attack surface

​

​Principle of Least Privilege

• The sum of all points where an attacker can try to enter a system

• Includes IoT devices, software interfaces

​

​Attack Surface

• IoT devices often lack robust security measures

• Key risks: Lack of updates, default credentials

​

​IoT

“Why are we able to trust ATM machines?”

Write a paragraph to explain why we can trust ATM machines that support the following points:

• Confidentiality.

• Integrity.

• Availability.

​

​CIA in your life...