Hi everyone.
I'm Chris.
And welcome back to my course on Enterprise Security fundamentals.
In this final section of the course I want to discuss with you some basic security concepts.
More from a management point of view and the first one as the CIA try it.
The CIA threat model is the basic model and the simplest model embraced by many organizations throughout
the security landscape.
So let's get into an overview of the CIA try it model the CIA try it is a good conceptual model for
thinking about the security of information the triad is composed of the concepts of confidentiality
integrity and availability.
There are multiple conceptual models for thinking about information security other conceptual models
such as the OED guideline for security of information systems and networks.
Include nine principles or the nests engineering principles for information technology security that
includes 33 principles.
Well there is no single generally agreed upon conceptual model for describing all of the aspects of
information security.
One of the the one of the major benefits of the CIA triad is its simplicity which drives easy adoption
by both information security workers as well as other stakeholders within the organization.
So let's have a look at.
I call them the three pillars of the CIA.
Try it.
So the first one is confidentiality.
The data pillar of the CIA triad involves ensuring that data is stored within an organization's information
systems only be accessible to authorized individuals.
There can be a variety of reasons for ensuring the limited availability of data from the data being
a matter of national or regional security.
The data being business critical intellectual property or the data involving an individual's personally
identifiable information or shortly be I that various regulations specify must be controlled in a particular
manner.
The confidentiality pillar of the CIA triad model is about putting in place the appropriate controls
to ensure that the dissemination of information is limited to the intended audience and remains unavailable
to an authorized persons.
For example an organization may have an online store the background information systems infrastructure
of this online store includes a database that hosts customers account data.
This data includes email addresses and associated online store password kept in the form of let's say
cryptographic hash a successful attacker might compromise the information systems of the organization
and get access to the email address and password hash bear right.
Even though the password was stored as cryptographic hash it is often possible by using a pre calculated
tables such as hashes known also as the rainbow tables to determine the characters that constitute the
original password.
Alternatively an attacker might compromise a database that stores customers credit card information
exfil trade the data and then sell it.
Another attacker might compromise organizations email system and publicly disclose sensitive internal
communications.
All of these scenarios would constitute a failure of information systems within the confidentiality
pillar of the CIA triad model.
As information has become exposed to those that should not have access to it now solutions such as Microsoft
Asia information protections or AIB allow organizations to address the confidentiality pillar of the
CIA try it.
Asian information protection not only allows protected files to be accessed by authorized persons but
can be used to limit how that access occurs.
For example blocking sensitive documents from being opened on unrecognized networks which drastically
minimizes the chance of information leakage.
I have included at the end of the Course as a resource link which explains in more detail.
This service or tool that is information Asia information protection now let's get on to the next pillar
of our CIA try it and that is integrity the integrity pillar of the CIA.
Try it involves ensuring that data retains its veracity over its lifetime.
Basically what this means is that data isn't modified or deleted without authorization.
Right.
It also means that authorized modifications are tracked as it is possible for an authorized person to
make an unauthorized modification.
For example if an Excel spreadsheet created several years earlier is subject to legal discovery as part
of an ongoing litigation.
The court will want to ensure that the spreadsheet hasn't been modified from its original state.
If an organization has put in place controls to address the integrity pillar of the CIA try it they
will be able to demonstrate to the court that the document is in the original and unmodified state.
When we talk about the integrity pillar of the CIA tried let's address some of some of its concepts.
Let's see.
And one of these would be integrity of data to address to address the integrity pillar of the CIA triad
an organization needs to ensure that the data retains its veracity and hasn't been subject to unauthorized
modification.
There are multiple risk involved in an organization that does not address the integrity pillar for example
information that is business critical could be modified or deleted that causing the organization financial
damage.
Ensuring that the integrity of data isn't just about ensuring that the data has the appropriate security
permissions applied while only authorized people should be able to modify data.
It's also necessary to ensure that it's possible to detect when authorized people make unauthorized
modifications to data right.
So this can only be done if auditing and change tracking are implemented and are following the industry's
best practices.
Let's talk about integrity of configuration right.
So the first part was integrity of data now integrity of configuration.
Date the configuration of information system is increasingly performed through code rather than traditional
manual methods.
Right.
So technologies such as Puppet Chef and partial desired state configuration transform data describing
system and application configuration into actual system and application configuration.
Right ensuring the integrity of configuration data is important because let's say a hypothetical attacker
could.
Rather than attacking a running system directly could instead attack the code that describes the configuration
of that system.
In doing so they would be able to indirectly modify the configuration of the systems making it simpler
to attack those systems the systems that host that code.
That describes the configuration of other systems needs controls in place to ensure that unauthorized
modifications are not made to the system configuration code and that all authorized modifications are
properly tracked.
That being said let's move on to the final pillar of our CIA try it and that is availability the availability.
Pillar involves ensuring that data is accessible to those that have permissions to access it when they
needed to have access to it.
Not only do the information systems that host the data need to be functioning in a reliable matter but
so do these security systems that protect the data as well as the networking systems that are used to
connect to the systems that hosts the data right.
This means that organizations need to ensure that the information systems that host the data as well
as those systems security and infrastructure dependencies are highly available to meet the availability
pillar of the CIA.
Try it.
Detailed information systems should remain available when information systems are under a predictable
load.
For example there were substantial problems with the 2016 Australian census as the Australian Bureau
of Statistics moved moved from manual to electronic collection of census data right on census evening.
The systems for handling the collection of the data failed meaning that the agency missed collecting
census data on a substantial percentage of the Australian population on the census date to meet the
availability pillar of the CIA.
An organisation needs to ensure that data remains available often Information System Information Systems
became unavailable either through equipment failure data corruption or natural disaster.
This means that the organisations also need to have an effective disaster recovery strategy regularly
moving backed up data to offsite locations.
Doing this will ensure that detail will remain recoverable if the primary storage site suffers catastrophic
failure or the data itself becomes corrupted either deliberately or inadvertently.
That being said I will see you in the next lesson where we will discuss how should an organisation prepare
from a security posture point of view.
I hope this has been informative for you.
Thank you for watching.