How do we know what security controls to assign to an asset to protect it.
Well you should know the answer to this as discussed.
We do a risk assessment considering the threats or abilities and consequences to the assets and select
appropriate security controls.
But what exactly do our assets need from our security controls the security controls need to enable
what we will call security attributes.
We need to consider the type of security control we might need for an asset is to think about the asset
in terms of its needs.
For confidentiality integrity and availability.
So let's define those three things.
Now confidentiality do we not want the asset disclosed to anyone.
I say that the asset is not disclosed to own authorized individuals entities and processes.
If that is true that the asset that defines the sort of security controls we need for that asset.
The next one.
Integrity do we not want the asset on intentionally altered.
Do we want to maintain and assure the accuracy and completeness of the asset over its entire lifecycle.
This means that the asset cannot be modified and authorized or undetermined manner.
Determining the security controls the last one availability do we not want it destroyed i.e. for any
asset to serve its purpose.
It must be available when it is needed.
This means the systems used to store and process the asset the security controls used to protect it.
The communication channels used to access it must be functioning correctly.
Again this is determining the types of security controls.
If that is a security attribute that the asset requires CIA it is known in the security industry as
the.
A triad.
Its a very old but still well used security paradigm.
And we can call these CIA these confidentiality integrity available.
They can call each of those security attributes all the security properties that an asset needs to be
secure as the security expert.
You need to help determine what the assets are and assign what security attributes that are required
for the asset so that it can be secured to within acceptable levels of risk.
You would do this by questioning the owner of the entity that you are trying to secure and find out
what they require.
What does security mean to the owner.
Thats why somebody can't say to you give me a secure system because you don't know what secure means
you have to ask them what secure means and what method one technique is to use security attributes and
find out what attributes those assets need.
Does it need see.
Or a.
So you do a requirements gathering for the security needs or attributes of assets.
You simply ask the owner what they want.
This isn't always a simple process because you have to guide them with your expertise and they tell
you what security means to them for that asset.
Many security attributes have been proposed over time see a being the original and well referenced but
it has its problems.
The CIA doesn't cover all security needs and it does not speak in the language of the business or the
way business people like to talk.
So in 1998 a guy called Don park proposed an alternative model to the CIA triad.
They called the six atomic elements of information all the park here and hexane the security attributes
are confidentiality.
As we've already known possession which is the new want integrity authenticity you know the new OWN
availability and utility and the new arm of the new ones from the CIA.
We have the first one possession or control is it can be called Let's define these.
This would be a loss of control or possession of an asset but does not involve the breach of confidentiality.
You've also got authenticity which refers to the veracity of the claim of origin or authorship of the
asset.
And then you have utility which means usefulness which again isn't part of CIA.
So for example ransom where bankruptcy uses data the asset then is no longer useful it has no utility.
So if you are just using the CIA as security attributes you would not have usefulness as an option but
you would have available you which is similar.
So these security attributes can be used to define asset security controls.
As we said not in the park area and aid is non repudiation.
And no the common security attribute we will see you mentioned if you read security literature.
So no repudiation in the law implies Warnes intention to fulfill obligations to a contract in cybersecurity.
It implies that one party of a transaction cannot deny having received a transaction or message.
Nor can the other party deny having sent a transaction or message a non repudiation and shows that the
sender can't deny sending the message.
And there's also two other important and well referenced security and abuse.
And those are authentication and authorization authentication verifies the identity of the user or system.
Is it what it claims to be.
Are you who you claim to be is the answer.
What it claims to be.
And then you have authorization so upon authentication of the identity or of an identity authorization
determines what is it allowed to access.
So authorization.
What is it allowed to access authentication verifies the identity of the user or system.
Is it what it claims to be.
So as you can see there are many security attributes that we might want to assign to an asset or think
about in terms of an asset in terms of security controls.
And from these this enables us to choose security controls that provide those attributes.
Let's get a little bit more tangible here with some examples.
So if something is encrypted this can provide confidentiality if something is hashed this can provide
integrity if something is digitally signed.
This can also provide authentication on repudiation and integrity is something is encrypted and digitally
signed.
This can also provide confidentiality authentication non repudiation and integrity.
So you can see that how we've gone from an asset to an obvious could attribute to then having security
controls encryption and hashing and digital signatures then meet those security attributes that where
if you didn't understand about what hashes or encryption all those things were going to go through as
we go through the course.
But it's just to show you the path through which we have our asset.
We have our security attributes and then we have our security control that meets our security needs
our security attributes.
So as you can see the way we're talking we're not really talking in the way a business owner or a business
person likes to speak.
And it's often a business that is the entity by which we're trying to secure in cybersecurity.
So this brings to light to use for designing security architectures that businesses and that's the ceps
business attributes.
And here we are.
If we look here we can see security attributes or as they call them business attributes.
But these speak a little better to the business to understand the security requirements i.e. security
controls for assets you determine if these business attributes here are acquired.
Maybe they're not required are they.
Nice to have your assets you would look at their use of attribute management attribute operational attributes
do you need detectability that need to be error free.
Or disability should it be legal will it be scalable.
Should it be governable and so on.
So that's confidentiality integrity and availability.
And I'm taking you a little bit further than what you might yet understand a security course where they
may just talk about the CIA.
I want to give you a little bit more of the real world where you need some more than the CIA through
to the parking area and heck sayd through to even having business attributes that come from sabse.
If you're interested more in sabzi and check out that link there.