This chapter is from the book
This chapter is from the book
This chapter is from the book
CIA-DAD
Before 1998, the United States Air Force came up with the concept of confidentiality in computing. After several iterations, they introduced a refined model of CIA-DAD to adequately cover topics of current day cybersecurity. But with the cyberattacks becoming increasingly numerous, we needed a set of rules for good security practice in the computer industry. Thus, the first Parkerian Model of six factors, or Hexad, was developed in 1998. The general consensus is that these are the rules for now but they’ll continue to evolve as attackers and hacking attempts evolve. We can minimize the risk but may never really eliminate cyberattacks or the risks associated with hacking attempts.
Let’s turn our attention to security fundamentals and the elements of the CIA-DAD triad (Figure 1-1).
)
Figure 1.1 CIA-DAD Triad
Confidentiality
According to NIST, confidentiality is “preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information.”
This term dictates that the data, service, or information is provided in a secure way. It does not mean that the information or data is provided to everyone who requests it. The information is provided to those who need it or who have a “need to know.” Once such a person requests information or data, their credentials are verified. After credentials are confirmed as currently valid, the data or information is given to the person. For confidentiality to happen, the user must sign a document known as a non-disclosure agreement (NDA), as well as any other documents an organization requires.
The opposite of confidentiality is disclosure, which means the data or information is disclosed to everyone without the need to check their credentials. Once information or data falls into the wrong hands, anything can happen, including problems associated with lawsuits and a flurry of financial troubles.
Integrity
Integrity demands that the service is providing the data or files in the original format without any modifications. When modified, the information can become useless or sometimes even harmful. For example, imagine your blood test or other medical test data is available from a lab to your physician. If one or two numbers have changed in the report sent to the physician, the results are inaccurate, which can cause alarm to the patient. Therefore, data transmission—electronic or otherwise—must be correct, accurate, and unchanged. As with confidentiality, the information or data is provided to “need to know” persons. Integrity of electronic transmissions is achieved by adding a hash to files and providing additional metadata.
The opposite of integrity is alteration or changed/corrupted data.
Availability
Usually, service providers such as cloud providers or Internet service providers offer some promise for their services, such as whether the service can be provided 24x7x365 or is more limited during some periods like holidays. Availability demands that during the mutually agreed times, data is available without delay. Some information is available at any time of day (hospital service, medical data, websites selling products, and so one), but other information is provided only during office hours (for example, medical billing and auto repairs). Some information is also available via self-service, which means a person can go to the data or information source (online or offline) and use proper credentials to obtain information at any time. For this type of service, it is assumed that the service provider keeps their website active all the time. Amazon.com shopping and Netflix streaming are examples.
The opposite of availability is destruction or that the information is not available when requested.
Note that when any one of the three factors is maintained, the other two factors come into play as well. When a service is available, the information is provided confidentially to those who have a need to know, and the provided data is unchanged and is in the original required or requested format.