-: Now, before we get too far into the course,
we need to start out with the fundamentals.
And that means the CIA triad.
And so when we talk about the CIA triad,
we are talking about three major components of security:
confidentiality, integrity, and availability.
When we have all three of these, we can guarantee
the security of our information security systems,
the data it contains, and the services that ride
on those systems, as you can see here in this picture.
Now when we talk about confidentiality,
let's talk about how secure our information is.
The other question is: how secure does the information
need to be?
Because every system is different.
When I talk about my website,
I don't need to have confidentiality of my data
that's publicly available.
In fact, I want the opposite,
I want everyone to go and see it.
But if I'm talking about my tax returns,
or my Social Security number, I may want to have
that information more secure.
And so, what are some best practices and best ways
to get the confidentiality of your data
in your information systems?
Well, the first one is physical protections.
You need to have things like locked doors, fences,
security guards, security cameras,
safes, keys, all of that kind of stuff
aids the physical security of the systems you're housing.
So if I have a data warehouse, a server farm essentially,
I wanna make sure that the front door is locked.
I wanna make sure the server room is locked,
that there's motion detectors and cameras
to protect if somebody's breaking in.
This is physical protections.
Now the second thing is, there's electronic protections,
and these are things like encryption,
whether it's in storage or in transit.
This is things like passwords and firewalls,
and two-factor authentication.
All of these keys to confidentiality
give you confidentiality of your information
by encrypting the data, by password-protecting the data,
or by putting firewalls in place so systems
can't reach your data.
If you have a failure of confidentiality,
it means that someone has been able to obtain
and view your data.
So if you look at the recent confidentiality breach
at Equifax, one of the major credit bureaus
in the United States, somebody had gotten in, and
was able to see the data that they were holding
on the customers.
So, they got Social Security numbers and birthdays,
and names, and all of that information
that was supposed to be confidential.
Because it wasn't encrypted properly,
or because there wasn't proper physical controls
or logical controls, someone was able to break in, and
breach that confidentiality.
Now, the second thing we wanna talk about is integrity.
And integrity isn't worried as much about can people
see the data, but they're worried more
about how correct that information is.
Has it been modified during retrieval, in transit,
or in storage?
And, the idea here is to make sure that, for instance,
your bank account, if you have $1,000 in there today,
you wanna make sure another zero isn't removed from that
and made it so you have $100 today.
You wanna make sure the data has pure integrity.
And so the way that we do that is by doing hashing
of files and information.
As you can see with that thumbprint on the screen there,
it has an MD5 hash associated with it.
Or, you want a checksum
that's occurred during data transmission.
So for instance, if you were doing a math problem,
back in grade school, you were always told
to check your work.
Well that's what a checksum is.
For instance if I send you a number,
a series of ones and zeroes, the last bit I might send you
would be a one if it's an odd number
and a zero if it's an even number.
And that way, you can check the data that I sent you.
So for instance, if I sent you one, one, one, one,
that's the number 15, right?
So if I wanted to send a checksum for that,
I would put an extra one on the end and you would know
that it's an odd number.
So when you get that, you go one, one, one, one,
that's 15, 15's odd, it's a one,
I got the right number.
That's a checksum.
Now, the idea here with integrity
is that if you have a failure of integrity,
it happens if somebody can modify the data,
whether it's in storage or in transit.
So if I put in a order over the internet,
and I wanna buy one copy of this course
but somebody put 10 copies of this course,
there's a breach of integrity.
The next thing we wanna talk about is availability.
This is the A in the CIA triad.
This talks about how much uptime the system is providing.
Is the data accessible at all times, by the user?
Now, if I have a website, for instance,
I want a high availability.
I want people to be able to access that information.
But if I had some secret information,
I might want it less available, right?
And that goes back to that confidentiality
we talked about earlier.
The best methods for availability are redundancies
in system design, including the components and data paths.
So, if I have one server and that server goes down,
my availability has failed,
but if I had two servers providing my website,
and it's load balancing, and one goes down,
hopefully the second one can hold the load
until we get the first server back up.
There's other thing you wanna do for availability
is having proper backup strategies
and disaster recovery plans, because
the more you can take that data and get it back up quickly,
it's gonna reduce your downtime and increase your uptime,
by the converse, right?
And so, if you have a failure of availability,
this is gonna happen if data cannot be accessed
by the end user.
So for instance, if you go to my website
and you get a 404, website not found,
because my server is down, that's an issue in availability,
and that's gonna be a problem for my company.
So we wanna make sure we have high availability
for our users.
So, when we talk about the approaches to security,
most people like to think of the CIA triangle
as this beautiful balanced approach to security,
as you can see here on the screen.
It has the confidentiality, integrity, and availability,
all in a perfect triangle with all sides being equal.
But in the real world, that just doesn't happen.
Instead, it may look more like this,
where you have high confidentiality and high integrity,
but low availability.
And this is something that is okay
if that's what your system entails, right?
If you want a high-security system,
like maybe your bank balance,
it's gotta be highly confidential,
'cause you don't want any people knowing how much
is in your bank account, high integrity 'cause you
don't want it to change, but you may not be as concerned
about the availability, because the other two
are more important.
Or, it may look more like this,
where you have a very low confidentiality
but high integrity and high availability.
A good example of this would be a website, right?
My website doesn't have to be confidential
because I'm putting information out there publicly.
Instead, I wanna make sure the data hasn't changed,
and I wanna make sure it's accessible to all people.
High integrity, high availability, low confidentiality.
The other thing we wanna talk about is how important
the CIA triad is, because it's in every single
cyber security course you will ever take.
They're gonna talk about the CIA triad.
Why is that?
Well, as a cyber security analyst, our job
is to characterize risks, attack, and security controls,
by assigning them to one or more of the CIA goals,
whether it's confidentiality, availability, or integrity.
And by doing this, we can say
this thing, this denial of service attack,
is a risk against availability.
That's right, if it's a denial of service,
it'd go against availability.
This data breach is a risk against confidentiality.
Those type of things.
And so, as we move through this course,
you're gonna be able to stop and think
about everything we talk about, through the lens
of either confidentiality, integrity, or availability,
because it's that important.
Now, going back to one more real-world example here,
security versus operations.
Can you have top-notch high security
all the time, everywhere?
Well, sure, but you're not gonna have
very good operations.
Now conversely, if I have very high operations,
I may have very low security,
because it is a trade-off.
As you increase security,
often systems become less useable,
and as you increase operations and operational tempo,
we sometimes take a risk by allowing less security
to get the job done.
So you gotta remember that as security increases,
often our useability and our operations are gonna decrease,
and it's always this trade-off between the operations folks
and the security folks.
And as a cyber security analyst, you've gotta keep this
in mind because you're gonna make recommendations
of how to increase security above all else,
but the operations team has to consider
how that's gonna affect their operations
and the mission of that business.