CIA TRIAD

 CIA TRIAD

Confidentiality

Confidentiality ensures that sensitive information is only available to people who are authorized to access it .

Security Controls for confidentiality data protection :

1. Encryption  -> Encrypting data with latest encryption mechanism
2. Access Control -> LDAP, Managed permission 
3. Steganography -> Hiding data within data , obscuring the data

Causes of Un-Intentional data disclosure :

1. Human Error
2. Oversight
3. Ineptitude

Violation of Confidentiality Attacks:

1. Capturing network traffic
2. Stealing password files
3. Social Engineering
4. Port Scanning
5. Shoulder Surfing 
6. Eavesdropping - Also known as sniffing or snooping attack , secretly listening 
7. Escalation of privileges

Countermeasures to ensure confidentiality:

1. Encryption
2. Network traffic paddling 
3. Rigorous access controls 
4. Strict Authentication process 
5. Data classification
6. Personnel Training 

Integrity

Integrity refers to prevention of un-authorized alterations to the data

Integrity Involves the following:

1. Preventing any un-authorized personnel or entity from making modification to the data of any kind. 
2. Preventing any personnel or entity from accidentally making modification to the data of any kind. 
3. Set up logging an tracking to track who or what is attempting to access/modify the data 

Integrity ensures that data objects and resources remain:

1. Unaltered
2. Preserved 
3. Correct

Integrity Violation Attacks:

1. All sorts of malware
2. Reverse shell codes
3. Vulnerable code
4. Human Error

Countermeasure:

1. IPS/IDS
2. Encryption
3. Mandatory security awareness training

Availability 

Availability ensures that resources are available when authorized users needs access to

Availability Concepts 

1. Usability
2. Accessibility
3. Timelines

Attacks and threats 

1. DOS
2. Natural Disaster 
3. Human error

Countermeasure:

1. Load balancers for DOS mitigation
2. Backups 
3. High fault tolerance