Integrity, Availability, and Information Security

<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgBSJKJHs7xR3Fl86JjSPdKxSV2eADlMtVyfL2CIHbwBMnAfdsJYBAmta8tl-UWb8VKnB5FUOtmiIDl96uZdnV0nNLk1a7z1yuZ2Ks9p6tHFUhQYxiZ62CyC_TqXZDi9IE4qxgJKLvclrOR/s1600/integrity+and+availability.png" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgBSJKJHs7xR3Fl86JjSPdKxSV2eADlMtVyfL2CIHbwBMnAfdsJYBAmta8tl-UWb8VKnB5FUOtmiIDl96uZdnV0nNLk1a7z1yuZ2Ks9p6tHFUhQYxiZ62CyC_TqXZDi9IE4qxgJKLvclrOR/s1600/integrity+and+availability.png" /></a></div><span style="font-family: Arial, Helvetica, sans-serif;">In an </span><a href="http://computersecurityconcepts.blogspot.com/2013/09/confidentiality-and-information-security.html" style="font-family: Arial, Helvetica, sans-serif;">earlier post</a><span style="font-family: Arial, Helvetica, sans-serif;">, I discussed confidentiality in the context of information security. In this post, I would like to elaborate on the remaining two components of the C-I-A security triad -- namely, integrity and availability. In order to understand the difference between confidentiality and integrity, remember that confidentiality is concerned with <i>access </i>to information assets, whereas integrity is concerned with <i>preventing unauthorized modification</i> of assets. Integrity, of course, is more difficult to measure than confidentiality because it is context dependent; that is, integrity has different meanings in different situations. Further, integrity of information assets is not a simple binary, true/false proposition. Instead, there are degrees of data integrity. For these reasons it is necessary for each organization to establish its own criteria by which to measure and evaluate the integrity of its information assets.</span><br /><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: Arial,Helvetica,sans-serif;">Broadly speaking, availability refers to the capacity of an information system to make information assets readily accessible to authorized parties in a timely and reliable manner. As with integrity, availability is also context dependent, and is thus a very complex issue. Put another way, availability means different things to different people. A CEO, for example, might measure availability by whether she can access her corporate dashboard while traveling. To a data analyst, by contrast, availability might be measured by whether she can carry out her statistical analyses in a timely manner without having to wait for the system to execute her requests. As a general set of guidelines, then, we might consider information assets to be available when organizational information systems (1) respond in a timely manner to user requests, (2) allocate resources among users fairly and equitably, (3) incorporate hardware and software that are fault-tolerant, and (4) employ a solid concurrency control strategy in order to accommodate situations in which multiple users are attempting to use the same information assets at the same time.</span></div>

Integrity, Availability, and Information Security

In an earlier post , I discussed confidentiality in the context of information security. In this post, I would like to elaborate on the rema...

Read more »

The Pillars of Information Security

<div class="MsoNormal"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhO-HiRWyJ2UHygtlopLZdfm5T-GpmH2CSOIihTsQIq3CHBEsNrawlIlkxhhFToWyMRtEee8hgJDicEw8DCAqPll5JuTY0Edxk_9aK31uHPKNZYJhBma-ITvVF-dEG1v5cI6yxC0XZSO22k/s1600/security+pillars.png" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><br /><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhO-HiRWyJ2UHygtlopLZdfm5T-GpmH2CSOIihTsQIq3CHBEsNrawlIlkxhhFToWyMRtEee8hgJDicEw8DCAqPll5JuTY0Edxk_9aK31uHPKNZYJhBma-ITvVF-dEG1v5cI6yxC0XZSO22k/s1600/security+pillars.png" /></a></div><span style="font-family: Arial,Helvetica,sans-serif;"><span id="goog_1946619458"></span><span id="goog_1946619459"></span>I’d like to begin this post by discussing information security threats in the context of what has come to be known as CIA -- confidentiality, integrity, and availability. The acronym CIA and the concepts for which it stands are commonly referred to as the <i>security triad</i>. One useful way of thinking about information security threats is that they are circumstances which have the potential to interfere with the confidentiality, integrity, or availability of an information system. Confidentiality, then, is simply the ability of the system to ensure that information assets are viewable or accessible only by authorized parties. Integrity, by contrast, is the ability of a system to ensure that information assets are modifiable or changeable only by authorized parties. Finally, availability refers to the ability of a system to ensure that information assets are usable by and accessible to all authorized parties. Confidentiality, integrity, and availability can also be seen as goals or objectives of information security, since together they represent three very desirable properties of an information system.</span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: Arial,Helvetica,sans-serif;">While the CIA security triad has been around for many decades, more recently other desirable system properties have also been identified; namely, authentication, non-repudiation, and auditability. With respect to the first two of these properties -- that is, authentication and non-repudiation -- we are referring here to information systems that support communication or messaging with other systems or other users. In this regard, authentication refers to the ability of a system to confirm the identity of the sender. For example, imagine that you receive a message from your boss which instructs you to immediately discontinue working on a critical organizational project, and instead direct your attention to another task. As the receiver of such a message, you would like to be able to confirm the identity of the sender; that is, you would like to be certain that it truly was your boss who sent the message to you. On the other side of technology-supported messaging is the concept of non-repudiation, which is a property of an information system in which a sender cannot convincingly deny having sent a message. Returning to our previous example, if you received a message from your boss instructing you to immediately discontinue working on a critical project, and if we assume that your boss genuinely did send that message, a desirable property of the system from your perspective would be to ensure that your boss could not deny having sent the message. Finally, we have auditability as a desirable system property. Auditability is simply the ability of a system to trace all actions related to a given information asset. If something goes awry in the future, auditability allows us to trace backward through time and determine who performed which actions at which times in order to ensure that responsible parties are held to account.</span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: Arial,Helvetica,sans-serif;">Together, these six concepts -- confidentiality, integrity, availability, authentication, non-repudiation, and auditability -- represent the pillars of information security.</span></div>

The Pillars of Information Security

I’d like to begin this post by discussing information security threats in the context of what has come to be known as CIA -- confidentiality...

Read more »