How the CIA Triad Helps Prevent Attacks

The CIA triad helps prevent attacks on all fronts. In this post, we'll discuss what the CIA triad actually is and how these three things can possibly cover the gamut of security infrastructure.

Table of Contents

What The CIA Triad Is

No, I'm not referring to the infamous 3-letter intelligence agency here. In fact, CIA, in the triad (or triangle) concept, is an acronym that is made up of confidentiality, integrity, and availability. If this doesn't look familiar, you need to know it to pass any security certification exam.

If any one of these concepts is missing, you have not actually secured your system or data therein. Which one is most important depends on the organization's mission and goals.

Confidentiality - restrictions on access and disclosure of information, protection, authorization, privacy.
Integrity - prevention of improper modification or destruction of information, nonrepudiation, accuracy, authenticity.
Availability - reliable and timely access to information, use of information, reliable service, recovery of critical systems, and business continuity.

1. Confidentiality

Think of confidentiality as privacy. You want to keep your data away from unauthorized people who could damage you or your organization. To meet this standard, you must protect your data from general access.

One method of maintaining confidentiality is encryption. Another is authentication. Authorized user access is key here.

2. Integrity

Think of integrity as consistency. You want to make sure your data maintains its quality as it's stored, transferred, or otherwise accessed. Inaccurate data is worthless.

Data is less likely to be changed when file privileges are in effect. Malicious people aren't the only worry here, as equipment failure is something to watch out for. You also want to prevent corruption or general data loss from crashes and power surges.

One method of maintaining integrity is backing up files, configurations, and builds. Altered information or data loss could be very costly. Maintaining trust in data is key here.

3. Availability

Think of availability as a provable way that your data is safe. You can't verify your data or systems are safe if you can't get to it. Even if you know no one will be able to get to it, what's the point of holding onto data or systems you can't use?

This facet of the triad is probably the most difficult one to achieve as there are so many things that can interrupt service or data availability. Your hardware and software must be up and able to be connected. Besides data, if you can't process orders or information, you could be dead in the water when you're supposed to be making money.

Your value could suddenly become meaningless. One method of maintaining availability is to prevent bottlenecks by clustering systems. Maintaining timely and uninterrupted access to systems and information is key here.

Attacks Separated by Concept

1. Attacks on Confidentiality

General unauthorized data copying from no protection, like an open database or repository.
Cracking weak encryption.
Man-in-the-middle attacks to intercept data in transit
Theft of personal storage devices like hard drives and flash drives.
Malware attacks open the door to other maliciousness.
Straight-up doxxing to bring attention to the private citizen's information for malicious reasons.

1.1 Goal of Attacks on Confidentiality

Cyber attacks typically begin with the desire to gain access to personal information like payment cards and personally identifiable information. Confidential information is stolen to achieve some type of personal, political, or economic gain.

2. Attacks on Integrity

Sabotage by a competitor, disgruntled employee, or stalker to disrupt normal operations.
Indirect compromises like typos or packet loss.
Planting malware to distribute bad software to others can make a normally safe asset, like a website, unsafe.
Falsifying records to perpetrate fraud.
Making a normally safe asset into a zombie to serve in a botnet to disrupt others.

2.1 Goal of Attacks on Integrity

This type of cyber attack is by someone looking to damage information or systems so the people who need them are out of commission. Sometimes, these are called slash-and-burn campaigns, as they are carried out with the goal of corruption instead of theft.

3. Attacks on Availability

Preventing normal business operations by way of network disruption, like DDoS attacks.
Preventing normal business operations by locking computer resources down within a network, such as Ransomware attacks.
Deliberate network or power disruption to take infrastructure offline.

3.1 Goal of Attacks on Availability

This type of cyber attack is by someone looking to disrupt normal business activities directly, not like stealing information or causing chaos as the first 2 concepts involve. These attacks could be moneymakers, as extortion is huge in this space. It could also be done to slow down or stop responses to other types of attacks.

Challenges of Maintaining the CIA Triad in the Modern World

Think of how well the CIA triad normally scales. By its very nature, the CIA triad helps prevent attacks and covers the gamut pretty well. However, emphasis on new technologies or the availability of legacy technologies over networks has caused challenges in modern organizations.

Application Security

There are more software companies than ever before. Application security has become front and center due to the ease of attacks, especially on web applications.

Rapid application development has led to DevOps, where teams usually prioritize business needs over security.

Many marketing agencies, for example, are run by marketers who hire coders and don't emphasize application security. They probably don't even know what the OWASP Top Ten is, let alone actively implement the concepts.

Big Data Security

Big data is one of those things you always used to hear over and over again. We can thank the advent of AI for switching gears here. While not actively discussed as much as it used to be, the practice of hoarding data still has massive privacy implications.

The vast amount of data that needs to be protected, along with the multitude of sources and formats, makes this a recipe for disaster. All of this data is just to make some kind of use or gain insights from all the information.

Cloud Security

More and more enterprises, especially municipal services, are moving to the cloud. This move comes with its own set of challenges, mainly who actually has access to the data and where the data is stored.

There are constant breaches of open databases and team setups. Cloud providers should really do a better job at helping enterprise users understand the implications of settings.

Critical Infrastructure Security

Aging critical infrastructure that was conceptualized and created without regard to network use and connection to future systems includes critical services such as electricity, water, traffic, and much more. Check out what DHS considers critical infrastructure by sector for more on this.

Due to the widespread nature and importance of this infrastructure, these sectors are vulnerable to cyber attacks. Besides disruption to essential services, we're potentially looking at a large loss of life. Due diligence and contingency planning are crucial here.

Internet of Things (IoT) Security

IoT is one of those collections of technologies that everyone loves to hate. Critical infrastructure is technically part of this section of technology as well. Failure to secure this collection of devices can lead to a massive botnet, not to mention huge privacy implications of sensitive data from multitudes of sources.

This set refers to the ever increasing number of devices that connect to the network. This isn't just computers, we're talking about printers, appliances, sensors, cameras, wearable devices, and more. This includes devices that traditionally have connected to the Internet and devices that traditionally have not been connected to the Internet.

IoT devices are especially vulnerable as they are shipped for ease of setup and use. Along with manufacturers not keeping up with security patching, most business owners and home users infrequently change default settings when manufacturers allow them to.