How Does the CIA Triad Protect Systems?

TL;DR

Protect systems by combining confidentiality, integrity, and availability. Access controls and encryption restrict information to authorized users, cryptographic functions reveal unauthorized changes, and defenses against denial-of-service attacks preserve access to resources. Together, these controls verify identity and privileges, protect messages and records, and keep services usable when legitimate users need them.

Transcript

Welcome back to our Cybersecurity Architecture Series. In the last video, I talked about five security principles you should always follow and one you should never follow. In today's video, we're going to talk about the CIA. No, not the spy guy: Confidentiality, Integrity and Availability. So let's get started with the first of these, Confidentiali... Read More

Key Insights

• Confidentiality is maintained primarily through access control and encryption, which together restrict protected information to authorized users and prevent observers without the required cryptographic key from reading intercepted messages.
• Authentication answers who a user is, while authorization determines whether that authenticated user has permission to perform the requested action. Passing identity verification alone does not guarantee access to a protected resource.
• Multifactor authentication proves identity by combining factors based on something a user knows, has, or is. Role-based access control then compares the authenticated user's assigned privileges with the requested activity.
• Symmetric encryption uses the same pre-shared cryptographic key for encryption and decryption. An authorized recipient with that key can recover the message, while an unauthorized observer sees scrambled information that cannot be read.
• Integrity is the quality that makes a message or transaction true to itself and makes modification detectable. Detection allows defenders to reject untrustworthy information and take appropriate countermeasures against tampering.
• Digital signatures and message authentication codes are cryptographic functions that can indicate whether records have changed. They help expose an attacker who deletes or alters system logs after conducting unauthorized activity.
• Availability means systems and resources remain accessible to authorized users when needed. A denial-of-service attack undermines this objective by submitting requests faster than a system can respond, preventing legitimate traffic from receiving service.
• A SYN flood exhausts session resources by initiating TCP handshakes and withholding the expected response after the server reserves capacity. A timeout limits how long resources remain reserved, allowing them to become available for other connection attempts.

Questions & Answers

Q: What is the CIA triad in cybersecurity?

The CIA triad consists of confidentiality, integrity, and availability. Confidentiality limits information access to authorized users through controls such as authentication, authorization, and encryption. Integrity makes unauthorized changes to messages, transactions, or records detectable. Availability ensures that authorized users can reach systems and resources when they need them, including when attackers attempt to overwhelm those systems.

Q: How does access control protect confidentiality?

Access control protects confidentiality through authentication and authorization. Authentication checks whether a person is who they claim to be, potentially using multiple factors based on something they know, have, or are. Authorization then examines the person's privileges and compares them with the requested action. Access is granted only when both identity and permission checks succeed.

Q: What is the difference between authentication and authorization?

Authentication answers the question of who a user is by checking the credentials or identity evidence they provide. Authorization answers whether that authenticated user is permitted to perform a particular action or access a particular resource. A person can therefore authenticate successfully but still be blocked because their privileges do not cover what they are requesting.

Q: How does symmetric encryption maintain confidentiality?

Symmetric encryption maintains confidentiality by using the same cryptographic key to encrypt and decrypt a message. The sender encrypts the original content so that it appears scrambled during transmission. An authorized recipient who already possesses the shared key can decrypt and read it. Someone without that key receives only the unreadable encrypted message.

Q: How can organizations detect tampering with system logs?

Tampering with system logs can be detected using cryptographic functions such as digital signatures and message authentication codes. These mechanisms allow one set of records to be compared with another so that changes become apparent. If an attacker elevates privileges and deletes evidence of unauthorized activity, defenders can determine that the log is no longer trustworthy and respond accordingly.

Q: How does a blockchain support data integrity?

A blockchain supports integrity by acting as a distributed ledger whose information can be verified by participants. New records can be appended, but existing entries are intended to remain immutable. If someone attempts to change a transaction, such as modifying an order quantity, or tries to delete an entry, cryptographic technologies can reveal and block that attempt.

Q: What is the difference between DoS and DDoS attacks?

A denial-of-service attack floods a system with requests faster than it can respond, consuming capacity and preventing legitimate users from receiving service. A distributed denial-of-service attack amplifies the same basic effect through multiple compromised systems. Those unsuspecting systems form a botnet under remote control and simultaneously send traffic to the targeted server, causing it to fail more quickly.

Q: How does a SYN flood make a server unavailable?

A SYN flood repeatedly begins the TCP three-way handshake but does not complete the expected exchange. Each incoming SYN causes the server to reserve a session resource and return an acknowledgment. The attacker then remains silent and sends more SYN messages until the available resources are exhausted. A timeout can limit how long each incomplete session keeps resources reserved.

Summary & Key Takeaways

• Confidentiality ensures that only authorized users can view protected information. Authentication establishes who a user claims to be, while authorization checks whether that user has the necessary privileges. Multifactor authentication, role-based access control, and encryption work together to prevent unauthorized people from accessing or reading sensitive resources and messages.

• Integrity means that messages, transactions, and records remain true to themselves, with unauthorized modifications detectable. Digital signatures and message authentication codes can reveal tampering with system logs. A blockchain also supports integrity by allowing records to be appended while preventing existing entries from being changed or deleted without detection.

• Availability ensures that authorized users can access systems and resources when needed. Denial-of-service attacks threaten availability by overwhelming a server, while distributed attacks use a botnet as a force multiplier. SYN floods exhaust reserved session resources, and timeouts can release those resources when an expected response never arrives.