The CIA Triad is an easy way to remember the fundamentals of IT security. Sometimes, you'll see this referred to as the AIC Triad to differentiate it from the federal organization in the U. S.
called the Central Intelligence Agency. However, since it's so easy to remember CIA, we often refer to the CIA Triad instead of the AIC Triad. But keep in mind that the CIA Triad has nothing to do with the CIA being the Central Intelligence Agency.
The "C" in the CIA Triad is confidentiality. We want to prevent someone from gaining access to private information; we need to provide that information in a confidential way. The "I" in CIA is integrity, where, if we're sending information from one person to another, we want to be sure that the recipient really is receiving exactly what was sent from the originator.
Lastly, the "A" in the CIA Triad refers to availability. Obviously, we want to be sure that all of our systems remain up and running at all times, even if we're implementing some type of IT security. You often see the Triad written as a triangle, and each leg of the triangle has confidentiality, availability, and integrity listed as the security objectives associated with the Triad.
One of the biggest challenges we have in IT security is making data available to others while ensuring that availability is only granted to the right people. We refer to this as confidentiality. One way that we provide this confidentiality is through encryption.
We can have one person encrypt data, send it to someone else, and that other person can then decrypt that data to be able to see the original plaintext. Obviously, anyone in the middle who happens to get access to that encrypted data has no idea what's on the inside, and if they were to look at that data, they would not be able to discern anything important from that information. Another common way to provide confidentiality is to set limits on what someone may have access to.
We commonly do this with access controls. We can limit who might have access to certain types of information. For example, this might allow someone in the marketing department to see all of the marketing presentations and be able to make changes to those, but it would prevent all access to any of the accounting information of the organization.
If you've ever had to provide additional authentication factors when logging into a system, that's another type of confidentiality; someone would not be able to access an account unless they had the proper authentication credentials, and adding those additional factors provides more confidentiality. When we're receiving data from a third party, we'd like to be able to verify that the data we have received is exactly the same data that was sent and that nobody has made changes to that data while it was traversing the network. We're able to do that by using methods of integrity.
One way to provide integrity is by hashing. The person sending the data will create a hash of the data and send you both the data and the hash at the same time. When you receive the data, you'll perform the same hashing function, and if your hash matches the sender's hash, then you know the data you've received is exactly the same as the data that was sent.
We can enhance this integrity by including a digital signature when we're sending data, which takes a hash and encrypts it with an asymmetric encryption algorithm. This means that we can check to make sure that none of the data has changed, and we can confirm the person who sent the data, providing an additional level of integrity that could be important if you're sending very sensitive data. It's also common to use certificates to identify devices or people and provide additional factors of integrity, especially when you're transferring data from one device to another.
Lastly, we have the concept of non-repudiation. This means that we have proof of integrity and can confirm without a doubt that the information we've received really did come from the originating party. If you've done any work in information technology, you know how important it is for your systems to be available.
Availability is that leg of the CIA Triad that ensures that people have access to the data they'd like to view. One way to provide this availability is to have systems that are designed to always be up and running. We might combine this with a system that has fault tolerance, where we have multiple components; if one of those components fails, the other component can pick up and continue to operate normally.
Of course, if you're concerned about systems being available, you'll constantly need to make sure that they are managed and updated by patching those systems. This ensures that the systems are always as stable as possible and that we can close any existing security holes, preventing someone from gaining access through some type of exploit.
