The CIA triad, and we're not talking 1
about intelligence. So when we talk about the 2
CIA triad and cybersecurity, we're 3
talking about confidentiality, integrity, 4
and availability. These three things make 5
up the core of defense of our networks. 6
If we can guarantee the confidentiality, 7
integrity, and security of our networks, we 8
will have a secure network for us to 9
operate in. Now as a hacker, what we 10
always focus on is how we can breach the 11
confidentiality, integrity, and 12
availability. So what is confidentiality? 13
Well, confidentiality answers the 14
question of how secure is the 15
information, and how secure does it need 16
to be. So if we have information like our 17
social security number or date of birth, 18
that's information that we want to keep 19
private, because we don't want attackers 20
to get that information. Conversely, if we 21
look at something like my personal 22
website, I want people to be able to see 23
that, and so I have that out there 24
without confidentiality attached to it. 25
So it's not that you always need 26
confidentiality, or you don't need 27
confidentiality. It really depends on 28
your use case. So what are some good ways 29
to protect your confidentiality? Well 30
some ways that we do this is for physical 31
things. For instance, if I have a file 32
that I want to keep confidential, I might 33
put it in a safe and lock it up. If I 34
have information I want to keep 35
confidential, I might use that as 36
encryption and I'll scramble up that 37
data and save in a different format so 38
that people can't read that information. 39
These are two ways that we can use 40
confidentiality, and as an attacker we 41
look for the weakest part of the 42
confidentiality train so that we can 43
break into it and get the information 44
that we want. So what is a failure of 45
confidentiality? Well, simply put, if 46
someone can read the information that 47
you've tried to hide, that is going to be a 48
breach of confidentiality. The second 49
part of the CIA triad is integrity, and 50
integrity is all about has the data been 51
changed. So the way we actually keep 52
track of whether data has been changed, 53
generally is by the use of something 54
called a hash. And we create this 55
checksum that actually looks at the data 56
and create a unique fingerprint of that 57
data, so we'll know if it's been changed. 58
If you change even a single bit inside 59
that data stream, the hash will become 60
vastly different. To ensure we have 61
integrity means that the data has not 62
been changed in retrieval, in storage, 63
or in transit. If we can do that, we can 64
ensure that we have good integrity of 65
our data. A failure of integrity is what 66
happens when we have data that gets 67
changed. So for instance, if you look at 68
your account balance and you have one 69
thousand dollars, and I change that to be 70
ten dollars, that would be a failure of 71
integrity. The third part of the security 72
triad is availability. And availability 73
really 74
focuses on "is the data available to be 75
retrieved when you want it to be 76
retrieved." So if a server is up, that's 77
good. If a server is down, it has no 78
availability. The way that we can get 79
availability, is that we can have 80
redundancy in our networks. So if I have 81
two servers performing the function of 82
one, if one went down the second one 83
would take the load, there will be still, 84
there'd still be good availability. One 85
of the most important things in 86
availability is having good backups, and 87
good disaster recovery. For example, if 88
I'm an attacker, and I go after a server 89
with a denial of service attack, and I 90
take down the server, can the company 91
restore to another server in a very 92
short amount of time? If they can, they 93
can keep their availability up, and keep 94
your customers happy. But if they can't, 95
then I can actually take this network 96
offline by doing my denial of service, 97
their availability it does suffer. So the 98
last thing we want to talk about when we 99
talk about our CIA triad is that it's 100
not actually a perfect triangle. So 101
really what comes down to is, each of 102
these things are important but they're 103
always important in different amounts 104
depending on your use case scenario. 105
Sometimes you'll have people who try to 106
get this perfect balance of all three, 107
and honestly that just doesn't happen 108
most of the time. Let's look at a couple 109
of examples. So in this example I have a 110
high confidentiality, high integrity, low 111
availability. Now what would be a good 112
example that. Well let's say I have 113
something that's really, really secret, 114
and really, really important, and I don't 115
want to be changed. Like let's say I have 116
some top-secret plans for the new Death 117
Star. I wouldn't want the rebels to get 118
ahold of that, so therefore I'm going to 119
take that, and i'm going to encrypt that 120
data giving confidentiality. I'm going to 121
do hash checking, so that if somebody 122
makes a change in the plans i'd be able 123
to detect that. But I might lock that 124
inside a safe, and put that safe inside 125
of a locked room, and that room inside of a 126
locked building, and so it's really hard 127
to get to. So my availability might be 128
low, but I'll have very good 129
confidentiality and very good integrity. 130
That's really important if you have 131
important data that needs to be kept 132
safe. Another way to look at this is 133
where we have low confidentiality but 134
high integrity and high availability. A 135
good example that would be a website. For 136
example if you go to my website, I want 137
you to be able to see the images and the 138
text that I put up there. Meaning that it 139
has good integrity that it hasn't been 140
changed, but I also want to be highly 141
available. I want anyone to be able to 142
get to it. There's no usernames needed, 143
there's no password needed, because I 144
just want you to be able to view it. So 145
in this case I have very low 146
confidentiality, but high integrity and 147
high availability. 148
So the last thing we want to talk about 149
is this trade-off that occurs. We have 150
this trade-off that happens between 151
operations and security, and it always 152
happens. If you look in your workplace 153
environment, you will want to have high 154
operations because you want to be 155
productive and make a lot of money in 156
your company. But you also want good 157
security, and the problem is as you 158
increase security often, the operations 159
to end up suffering. And the reason for 160
that is there's always this trade-off. 161
For example if I require everyone to log 162
in with a username and a password and a 163
token that's a little bit harder on 164
operation so it slows them down, but it 165
gives me much better security. Conversely, 166
if I let everyone just log onto the 167
computer with a shared account that 168
everybody's the same username password, I 169
have zero security but it's very quick 170
and efficient to do. So, it's always going 171
to be this trade-off, and we have to 172
consider that when we build our systems. Now, 173
as an attacker we're always going to be looking 174
at where are those places that 175
operations has taken over and security 176
has lapsed. For example, if five people are 177
using the same username and password, I 178
can go after any one of those five 179
people using social engineering attacks, 180
and be able to get that username or 181
password, and now I can break that system.