-: The CIA triad.
There are three components that lay the foundation
for most of what we're going to cover inside this course.
We call this the CIA triad.
Those three components are confidentiality, integrity,
and availability, and when we have all three of those,
it means that our data and our information
has good security.
But if I lose one of those, that becomes a vulnerability,
and an attacker could exploit it.
Now, let's look at each of those inside of this lesson.
The first is confidentiality.
Confidentiality ensures that the information
has not been disclosed to unauthorized people.
Let's pretend that you had a document,
and you wanted to make sure that nobody could read it
except for you.
How are you going to protect it?
Well, in the physical world,
you'd take it and put it in an envelope, seal the envelope,
put it in your filing cabinet,
and lock the filing cabinet with a key.
That would ensure that only somebody who had the key
could read that file.
This is going to give you good confidentiality.
Now, in the digital world,
we wouldn't do it with a physical key.
Instead, we would use things like a public or a private key,
and encryption algorithms,
and we're going to discuss both of those
later on in this course.
So in this course,
what I want you to remember is any time you hear encryption,
you should automatically be thinking confidentiality,
because if you're using encryption,
you're making sure the file or the system
has good confidentiality.
Let's put this another way.
Let's say you wanted to look at your bank balance,
but you wanted to make sure that only you
could look at that bank balance.
How could you do that?
Well, you might use a password,
and that password would authenticate you to the server
to allow only you to be able to see your bank balance.
Now, you could go in
and you could change that balance as much as you wanted,
but only you are allowed to view it.
That still maintains confidentiality,
but it does bring us to another problem, which is integrity.
Integrity means that we're focused on ensuring
that the information has not been modified or altered
without proper authorization.
So let's go back to the example I just gave you
of looking at your bank balance.
If you're able to sign into your bank account,
see that balance,
that means that you've already passed
the confidentiality test.
If you have the right key, or in this case, your password,
you could do that,
but you can't go in and go change your bank balance.
If you could, that would be a breach of integrity,
because data was being modified by you
and you're not supposed to have the ability
to modify your bank balance.
Only the bank has the authorization to do that.
Let's look at it a different way.
Let's say that you had $10,000 in your checking account,
and a bank teller decided to change that without permission
and she made it $10.
You would be pretty upset with that breach of integrity,
wouldn't you?
I know I would.
This is what we're talking about with integrity.
We want to make sure the value that's there, stays there
unless it's changed by an authorized person.
When we talk about integrity,
the thing that's going to come up time and time again
is a thing called hashes,
and we'll talk about hashes
when we get into the cryptography lesson
later on in this course.
The third component we have is availability.
Availability is focused on ensuring
that the information is able to be accessed, stored,
or protected at all times.
So going back to our bank example,
if I wanted to go to my bank right now
and go to their website and look at my bank balance,
I had to have the right key, my password,
to ensure I had good confidentiality,
and when I get there,
the data value should not have changed,
that says that I still have $10 in my account
that I had yesterday.
That's good integrity.
But what happens if I go to bank.com
and I get a webpage that's not available?
Well, that means I've lost availability.
I can't access the data.
I don't know how much is in my checking account, and so,
while maybe maintaining confidentiality and integrity,
if there's zero availability,
it becomes no use to me as a consumer,
and that's why these three things are very important
as they work together to provide us with usable systems
that have confidentiality, integrity, and availability.