From the course: IT Security Foundations: Core Concepts

Providing a secure system

From the course: IT Security Foundations: Core Concepts

Start my 1-month free trial Buy for my team

Providing a secure system

“

- [Instructor] One of the basic principles of providing a secure system is to manage risk and protect sensitive information. The goal is to keep data private, unchanged and available. This concept is called the CIA triad, a widely-recognized information assurance model. CIA stands for confidentiality, integrity and availability. Let's talk about each of these, starting with data confidentiality. Confidentiality is the promise of keeping private information private by preventing unauthorized access. Private information can include personally identifiable information which is something that could identify someone and includes social security, credit card, or bank account numbers. It can also include business information, such as data, employee records, and trade secrets. An example of a violation of confidentiality would be a hacker gaining access to a government mail server and reading the emails, or someone other than your doctor's office gaining access to patient records and reading your medical file about your health issues. Keeping data private is very challenging in today's digital world, where nearly everyone, including companies, social media, hospitals and many others collect, store and share our information. Next, let's talk about ensuring data integrity. Integrity is protecting data from unauthorized change. Data integrity can be compromised when information has been altered or destroyed, either maliciously or accidentally. An example of a violation of integrity would be a student going into the grade book and changing his or her algebra grade from a C to an A, or someone gaining access to a bank record and changing the account balance. Finally, let's investigate the importance of ensuring availability. Availability is ensuring data and services are available only to authorized users when needed. Authorized users should be able to reach the data when needed, but there are a couple of threats against availability. Threats include a distributed denial-of-service attack and ransomware. A distributed denial-of-service attack, or DDoS, is an effort to interrupt or suspend services to legitimate users. A DDoS attack uses armies or botnets, which lie and wait, and, at a pre-defined time, will launch an attack by sending multiple requests to a system and lock out legitimate users. And ransomware holds data hostage and prevents access until you pay a ransom. If the ransom is not paid, the consequences could be grave. Now, let's test your knowledge. One of the basic principles of providing a secure system is to manage risk and protect sensitive information. Describe what it means to ensure data confidentiality, integrity and availability. You can record your answer on the challenge worksheet.

Contents