Well, it's time for you and I to talk about the key components that we are going to be using any time
we are working in information security.
And you probably have heard of our first topic.
It's the CIA triangle or the CIA triad.
And no, we're not talking about the Central Intelligence Agency here in the United States.
We're talking about confidentiality, integrity and availability.
Any time that we are thinking about securing some type of information technology system or architecture
or component, we like to think in terms of CIA, at the very least, confidentiality, integrity and
availability.
What do each of these mean?
Well, let's explore each of them in detail and even talk about some of the elements that didn't make
it into this CIA that we also think of today.
Now it turns out that confidentiality is what most people think of when they think of security and information
systems.
But this is only one element that we think of.
Confidentiality, of course, refers to making sure that data is readable by authorized AIS only.
So we're making sure that no one that is unauthorized can read the data.
And of course, we immediately think about encryption when we think about confidentiality.
Sure, we can encrypt this information.
Maybe it's text, and then if someone sees it, it appears to be gibberish.
Yeah, they can't make any sense of it.
This is a common encryption methodology that keeps our data confidential.
Now, keep in mind that data classification is an area that we'll be discussing in confidentiality,
because not all of your information requires the same level of secure treatment.
We'll talk about different data encryption routines that are available.
And let's not forget that making sure your sensitive data is not read by unauthorized eyes is also going
to mean that you're disposing of your data properly.
Are you disposing of those old disk drives so that they can't be read after the fact?
This is another important area that we don't often think of when we think confidentiality at first.
Now because we tend to think of confidentiality.
The minute we think about keeping our resources secure, integrity might be a little trickier for us
to envision.
But what this is all about is a measure of the trustworthiness of the data.
Think about it.
If we encrypt the data, we're keeping it confidential.
But what if someone grabs the data that we're sending and does bit flipping?
That's right.
What if they manipulate the bits in this data?
Well, that's going to be a problem.
They have messed with the integrity of our data.
And so we want to make sure that data is not transmitted in a fashion in which it can be manipulated
undetected.
This, of course, renders something like a simple bit flipping attack impossible because if there's
any change to the data that we're sending, the integrity violation would catch it.
As you'll see in this course, we're going to be using things like checks, arms and access controls,
as well as hashing algorithms and mechanisms to ensure that our information has not been tampered with
in transit.
By the way, the A in the CIA triad stands for availability, and this is an easy one to envision.
It's just making sure that the data is there when those authorized individuals want to access it.
This is the most complex really of all of these chunks, CIA, because I say it's complex because there's
so many different aspects that go into availability.
I mean, sure, we need to make sure that viruses and distributed denial of service attacks aren't rendering
things unavailable.
But let's face it, we need to make sure that we don't have single points of failure at any point in
the system, or the system could be rendered inoperative.
This is why we use complex things like disk arrays and even server clustering these days to make sure
that some component data specifically that needs to be available always is.
What about non repudiation?
This is another aspect that we've added to the CIA triangle over the years because we typically want
to ensure these components as well.
Non repudiation means that the sender cannot deny sending and the receiver cannot deny receive it.
So we have this non repudiation in the data transmission and we can often achieve this utilizing digital
certificates which will be exploring in depth in this course.
Another component to the CIA triangle is authenticity.
We want to make sure that the quality is genuine and uncorrupted and smartcards and digital certificates
can help us with this.
And notice, this is very similar to integrity checking.
But here we're making sure that the quality is genuine, meaning that this information did come from
a specific party.
So think about it.
The CIA triangle with its confidentiality, integrity and availability combined with non repudiation
and authenticity.
These five components are something we should always be thinking about whenever we are thinking about
securing information technology resources.
Thank you so much for viewing.