Skip to main content

CIA - Confidentiality, Integrity, and Availability



Confidentiality : Only authorized entities have access to the data

Example                : 
Information that could be considered confidential are health records, financial account information, criminal records, source code, trade secrets and military tactical plans.
Controls Expected : Identification and authentication, Authorization, auditing and logging 

                                     
Integrity            : No unauthorized modifications of the data 
Example                : Unaltered data
Controls Expected :logical and physical access controls, backups, file integrity monitoring and Change Management monitoring and privileged user access review
Availability           : Availability guarantees that systems, applications and data are available to users when they need them
Example                : A loss of availability is the disruption of access to or use of information or an information system.
Controls Expected : Security controls that can provide availability protection include load balancing, clustering, controlled traffic flows, intrusion detection, fault tolerance and recovery mechanisms
                                                

Comments

Post a Comment

Popular posts from this blog

Understanding Ransomware

Ransomware is a type of malicious software designed to encrypt or block access to a victim's files or entire computer system. The attackers demand a ransom payment, typically in cryptocurrencies, in exchange for providing the decryption key or restoring access. This insidious form of cyberattack has evolved over the years, becoming more sophisticated and causing significant disruption.   The impact of ransomware attacks can be devastating on multiple levels. For individuals, it can result in the loss of personal data, compromising sensitive information like financial records or personal documents. In businesses, ransomware can disrupt operations, leading to financial losses, reputational damage, and potential legal implications. Critical infrastructure, such as healthcare or government systems, can also become targets, risking public safety and national security.
Post a Comment
Read more

Information security !!!

 
Post a Comment
Read more

Different types of cyber attacks

Malware attacks: Malware attacks involve the use of malicious software, such as viruses, worms, or ransomware, to damage or disrupt systems or steal sensitive data. Phishing attacks: Phishing attacks involve the use of fake emails or websites to trick individuals into revealing sensitive information, such as passwords or financial data. Denial of service (DoS) attacks: DoS attacks involve flooding a network or website with traffic in an attempt to make it unavailable to users. SQL injection attacks: SQL injection attacks involve injecting malicious code into a database through a website or application in order to gain unauthorized access or steal sensitive data. Man-in-the-middle (MitM) attacks: MitM attacks involve intercepting communications between two parties in order to gain access to sensitive information or to alter the content of the communication. Insider attacks: Insider attacks involve the use of an individual's authorized access to systems or data to compromise the secu...
Post a Comment
Read more