How Does the CIA Triad Protect Systems?

TL;DR

The CIA triad protects systems by combining confidentiality, integrity, and availability. Access control and symmetric encryption restrict information to authorized users, digital signatures and message authentication codes reveal unauthorized changes, and defenses such as timeouts help preserve access during SYN floods. Read on to see how authentication, authorization, encryption, integrity checks, and availability controls each address a distinct security risk.

Transcript

Welcome back to our Cybersecurity Architecture Series. In the last video, I talked about five security principles you should always follow and one you should never follow. In today's video, we're going to talk about the CIA. No, not the spy guy: Confidentiality, Integrity and Availability. So let's get started with the first of these, Confidentiali... Read More

Key Insights

• Confidentiality is maintained primarily through access control and encryption, which together restrict protected information to authorized users and prevent observers without the required cryptographic key from reading intercepted messages.
• Authentication answers who a user is, while authorization determines whether that authenticated user has permission to perform the requested action. Passing identity verification alone does not guarantee access to a protected resource.
• Multifactor authentication proves identity by combining factors based on something a user knows, has, or is. Role-based access control then compares the authenticated user's assigned privileges with the requested activity.
• Symmetric encryption uses the same pre-shared cryptographic key for encryption and decryption. An authorized recipient with that key can recover the message, while an unauthorized observer sees scrambled information that cannot be read.
• Integrity is the quality that makes a message or transaction true to itself and makes modification detectable. Detection allows defenders to reject untrustworthy information and take appropriate countermeasures against tampering.
• Digital signatures and message authentication codes are cryptographic functions that can indicate whether records have changed. They help expose an attacker who deletes or alters system logs after conducting unauthorized activity.
• Availability means systems and resources remain accessible to authorized users when needed. A denial-of-service attack undermines this objective by submitting requests faster than a system can respond, preventing legitimate traffic from receiving service.
• A SYN flood exhausts session resources by initiating TCP handshakes and withholding the expected response after the server reserves capacity. A timeout limits how long resources remain reserved, allowing them to become available for other connection attempts.

Questions & Answers

Q: What is the CIA triad in cybersecurity?

The CIA triad consists of confidentiality, integrity, and availability. Confidentiality limits information access to authorized users, integrity makes unauthorized modifications detectable, and availability keeps systems and resources accessible to authorized users when needed.

Q: How does access control protect confidentiality?

Access control combines authentication and authorization. Authentication verifies who a user claims to be, while authorization checks whether that user's privileges permit the requested action. Access is granted only when both checks succeed.

Q: What is the difference between authentication and authorization?

Authentication answers, “Who are you?” by checking credentials or other identity evidence. Authorization asks whether the authenticated user has permission to access a resource or perform an action. A user can pass authentication but still be denied access because they lack the required privileges.

Q: How does symmetric encryption maintain confidentiality?

Symmetric encryption uses the same pre-shared cryptographic key to encrypt and decrypt a message. The authorized recipient uses that key to recover the original content, while an observer without the key sees only scrambled information.

Q: How can tampering with system logs be detected?

Digital signatures and message authentication codes can indicate whether system-log records have changed. If an attacker elevates privileges and deletes evidence of unauthorized activity, these cryptographic functions help defenders recognize that the log is no longer trustworthy.

Q: How does a blockchain support data integrity?

A blockchain acts as a distributed ledger whose records can be verified by participants. New entries can be appended, but existing entries are intended to remain immutable, so attempts to change or delete a transaction can be detected.

Q: What is the difference between DoS and DDoS attacks?

A denial-of-service attack overwhelms a system with requests faster than it can respond, preventing legitimate users from receiving service. A distributed denial-of-service attack uses multiple compromised systems in a botnet as a force multiplier, sending traffic to the target simultaneously.

Q: How does a SYN flood make a server unavailable?

A SYN flood repeatedly starts the TCP three-way handshake without completing the expected exchange. The server reserves a session resource for each attempt until its resources are exhausted. A timeout releases resources when the expected response does not arrive.

Summary & Key Takeaways

• Confidentiality ensures that only authorized users can view protected information. Authentication establishes who a user claims to be, while authorization checks whether that user has the necessary privileges. Multifactor authentication, role-based access control, and encryption work together to prevent unauthorized people from accessing or reading sensitive resources and messages.

• Integrity means that messages, transactions, and records remain true to themselves, with unauthorized modifications detectable. Digital signatures and message authentication codes can reveal tampering with system logs. A blockchain also supports integrity by allowing records to be appended while preventing existing entries from being changed or deleted without detection.

• Availability ensures that authorized users can access systems and resources when needed. Denial-of-service attacks threaten availability by overwhelming a server, while distributed attacks use a botnet as a force multiplier. SYN floods exhaust reserved session resources, and timeouts can release those resources when an expected response never arrives.