We started this course off with a question, what is security?
And that is a question that's hard for many people to actually answer.
Security for them couldn't be based on a perception
of what they think security is, it's not necessarily positive,
and that includes management.
Management was raised maybe in an era of finance or
marketing or one of those career paths,
and now all of a sudden they have this concern about information security,
but they don't even know what it is,
so that's why it's good that we have the information security triad.
This is often known as the CIA triad,
and it really deals with three core principles or pillars of a security program.
The first is dealing with confidentiality,
the second, integrity, and the third availability.
Because these are terms that management and everybody
can understand confidentiality, integrity,
and availability,
this allows us to define a complex term like security in a meaningful way.
When we look at confidentiality, obviously,
what we're trying to do is protect something which should
be kept secret from improper disclosure.
In some cases, we have to disclose information,
but we don't want to disclose information that should not be disclosed.
So we're protecting individual's privacy such as employee and customer data.
We're protecting secrecy that trade secrets of our organization,
for example, and our research, our marketing plans.
We need to protect these because if an adversary or a
competitor was able to get access to these,
it could be that that would undermine the future
profitability of the organization.
The second part of the CIA triad is integrity.
Integrity is all about accuracy.
Not only accuracy of the data,
but also the accuracy of the way we process the data.
We want to protect our data from improper modification.
When we're transmitting data over a network,
for example, if there was noise or anything that could disturb that network,
could it corrupt the data?
Well then the data is not trustworthy anymore.
If a person makes a deposit at the ATM machine to
put money into their bank account, they don't want it to be close,
but it went to somebody else's account, but not theirs,
so integrity of the process as well.
This means we have to make sure that we don't have
unauthorized users able to access or change our data,
but we also have to make sure that users that do have
authorization only can change data in authorized ways.
So certain fields, maybe they can't change, but others they could.
So what is that idea of an authorized entity?
An authorized entity is a person who has given then that level of trust
and privilege that is able to access or modify data, and that is often
done through a process we call authentication.
A person says yes, I am Joe,
but how do we prove they are Joe and not somebody else pretending to be Joe,
what we call spoofing or masquerading, and we use
authentication for that to validate who they are.
This is something we'll look at,
especially in a very important area that is Domain Three: Access Controls.
We quite often will use multi‑factor authentication,
or MFA,
and this means that when a person is going to be authenticated
maybe by knowing a password or having a smartcard or an
employee ID badge or by biometrics,
we don't just use one of those three forms of authentication,
we always use at least two of them.
So that means we're not trusting just a single authentication technique.
If you know the password, well you must be Joe.
Well we don't know if somebody else has learned what Joe's password is.
The third part of the triad is availability.
Availability means that our systems and our data are
accessible when they're required.
Now some system's availability is more important than others.
We take email, for example.
For many departments and most organizations,
email is an important communications tool,
but if email went down for an hour over lunch,
nobody would notice.
We don't need 100% availability on something that doesn't
require that level of redundancy and protection,
but we want to know what systems do need to be
available as close to 100% as possible.
So availability is the protection of our systems from
being unavailable or destroyed, for example,
through things like having backups,
making sure that a person is not able to be deprived of access maybe through
something like a distributed denial of service attack,
or through something like a cut cable or equipment failure that
now that system is not there when it's needed.
One of the ways we address this is through redundancy.
Have alternate paths, more than one cable,
more than one power supply, more than one backup,
so we're able to ensure that even if there is a failure
even to say one piece of the equipment,
we can failover and run using that other piece of equipment.
When we look at the term non‑repudiation,
this is not really a part of the CIA triad,
but it's good to look at it here as well.
To repudiate is to say I didn't do it.
In today's network world, we need to establish who made that order,
who made that change so they can't turn around later and repudiate.
Oh, I didn't do it.
So we establish non‑repudiation.
This can be defined as protection against an individual who
falsely denies having performed a certain action.
And this then provides the capability to determine whether
an individual took a certain action, such as creating a new customer record,
sending a message, approving something, or receiving the message.
This is how it's defined in the National Institute of Standards and
Technology Special Publication 800‑53 r5, so it's a good benchmark for what
is a good definition for what non‑repudiation is.
In summary, throughout this module,
we've set out a foundation for our information security program.
We've defined some key terminology, and of course,
we know that security requires oversight.
It doesn't just happen.
It must be managed with a strategy of what we're going to try to do,
but then actions to back up and to realize that strategy.