Work for the CIA (Confidentiality, Integrity, Availability)

October is Cybersecurity Awareness Month! Throughout the month, we’ll release several articles on cybersecurity best practices and a brief rundown of related topics. This first article covers CIA (Confidentiality, Integrity, and Availability) and how you can apply it in your network.

What is the CIA?

Also known as the CIA Triad, these three concepts are the goals that any secure network should strive for.

Confidentiality, the first in the triad, deals with data and resource privacy. The goal of confidentiality is to prevent or minimize unauthorized access to data. An example of a confidentiality violation is HR accidentally emailing sensitive documents to the whole company. Confidentiality violations can occur not just from user error, but also from policy misconfigurations. Countermeasures include data encryption, strict access controls and policies, and extensive user training.

Integrity ensures the data or resources being protected are reliable and correct. This means preventing unauthorized changes to information or changes to your information by unauthorized users. Common attacks that aim to violate integrity include viruses, logic bombs, and system backdoors. To counteract this, network admins should ensure data integrity using methods such as hash functions, intrusion detection systems, and data encryption.

Integrity and confidentiality go hand in hand, much like the countermeasures needed to maintain both. You can't guarantee data integrity if confidentiality is broken because anyone can change the data. Similarly, you can't maintain confidentiality if the security infrastructure's integrity is compromised. Both depend not only on access control, but also on personnel training to protect your data and network.

Availability means authorized users can access data or resources in a timely, uninterrupted manner. This means a network should have enough bandwidth to support users accessing the resources they are authorized to access. Availability also covers redundancy and business continuity. As such, threats to availability include device failures, software errors, and environmental challenges such as power outages or natural disasters.

Availability depends on both confidentiality and integrity to remain intact, but if the latter two are too strict or overreaching, it may compromise availability. Usability and accessibility are key factors in availability. For example, if an intrusion detection system is too stringent in examining packets across the network, that may hamper availability if access speed is critical.

How do I implement CIA in my network?

For confidentiality and integrity, access control is key. User-based access control is fairly standard, which ensures that only authorized users can make changes to the network. For cleanliness and simplicity, role-based access control to networking equipment is preferred if the equipment supports it. VLAN isolation between LANs will also add another layer of security for the confidentiality and integrity of data and resources.
 

For availability, follow business continuity best practices for your physical network. An uninterruptible power supply (UPS) will help keep your devices running during small power hiccups and allow for graceful shutdowns during extended outages. It’s also worth investing in a dedicated backup solution to keep your data intact in the event of hardware failure. You’ll also want to limit single points of failure as much as possible to ensure critical operations can continue during an emergency.

How are you implementing the CIA Triad in your network? Got any advice for people wanting to make more conscious decisions in their network security?

Let us know in the replies!

Info for this guide is based on the Official Study Guide for the CISSP.