Introduction

The CIA Triad is the primary objectives for Cybersecurity. The CIA, instead of standing for the Central Intelligence Agency, means Confidentiality, Integrity, and Availability.

Confidentiality

Confidentiality is the aspect of privacy and covertness for information data. Providing this privacy involves protecting against access from unauthorized persons who are attempting to bypass security measures, exploit weaknesses, and acquire sensitive information. There are several methods that can be used to protect systems from attackers. The foremost step that can be taken is training employees. They can be made aware of and trained in password-positive actions like maintaining strong passwords. A strong password is characterized by complex variation, number and symbol mixes, personalized addition, symbol substitution, capitalization, and symbol replacement. They can also be trained in detecting social engineering techniques. Social engineering attacks manipulate people into sharing access to Personally Identifiable Information, visit malicious websites, or send money to the attackers. Encryption techniques like the Advanced Encryption Algorithm also provide a barrier in defense of data because they convert plaintext to ciphertext and make data unreadable to attackers.

Integrity

Integrity ensures that data, whether intentional or not, remains unaltered upon transit and arrival and is accurate, consistent, and trustworthy. Altered data can be corrupted, making errors or malicious changes that compromise a business or self. File permissions, user access controls, and version control are techniques that prevent this unauthorized alteration. You can also employ cryptographic techniques like SHA-2, digital signatures, and malware detection systems to prevent attacks such as a Man-In-the-Middle attack.

Availability

Availability is making sure that information is always readily accessible by authorized users. This ensures business continuity, which is essential because downtime of data can lead to financial losses, reputational damage, and operational disruptions. Some common threats to availability include Denial of Service attacks, hardware failures, and natural disasters. Implementing redundancy measures such as STP, fallback servers, load balancers, and disaster recovery plans can aid in providing data availability.

Authentication vs. Authorization

Authentication is different from authorization in that authentication verifies the identity of users accessing data and authentication is determining what permissions an authenticated user has and what resources they can access. The OpenID Connect protocol is an authentication protocol and the OAuth 2.0 protocol covers the overall system of the user authentication process.