Madison Williamson<\/p>\n\n\n\n
The CIA Triad is a guideline for IT groups to follow to ensure they prevent attacks or loss of information. It contains three parts, Confidentiality, Integrity, and Availability, each of which make up best practice standards.<\/p>\n\n\n\n
Confidentiality can be explained as keeping information that should not be shared secure and only accessible to those who have permission to view it. Methods of doing so include encryption of stored information, User permissions set for folders or drives to prevent unnecessary access, and requiring more identifying information from those wishing to access files. Encryption is key here, an unencrypted file is open to anyone that can gain access to it, therefore it is a liability. Ensuring individuals who have left the company for ANY reason have their access removed in a timely manner will prevent bad faith access and removal of information by an individual who is upset for any reason. Requiring identification for access to information from outside sources, such as a bank account number or drivers license number, can also help confirm the identity of the individual making the request for information.<\/p>\n\n\n\n
Integrity involves methods used in Networking since the beginning. Checksums, encryption checksums and even backups are parts of what network admins have been doing for decades now. Checksums verify that the information being received wasn\u2019t edited enroute to its final destination. Encryption Checksums prevent you from even reading the file if the keys don\u2019t match due to the information not being able to be parsed. And backups ensure that even if you lose a server, a workstation, or any drive, you can regain the information on that hardware through a recovery process thanks to timely backups. Backup verification can be time consuming and boring but it will save you in the future.<\/p>\n\n\n\n
Availability is the reason we monitor network devices, it is the reason reboots for patching systems are scheduled, and it pushes for a Disaster Recovery plan to be in place in case anything happens to a remote or local site. Monitoring network devices will allow you to recognize when an outage occurs before the customer or users send you angry messages, there are many monitoring systems available and they are worth the money for this reason. Reboots are a needed operation for all device types, systems need to have software upgrades, hot fixes for newly discovered malware or vulnerabilities, or a device can just time itself out and need to be restarted. By ensuring you schedule these outages the users won\u2019t lose out on availability to the network at inopportune times. A Disaster Recovery plan gives you and your team the steps and guidance necessary when a site goes dark for any reason, it allows for a speedy recovery of your network connections or what to do during a cyber security incident. Training your team on the Disaster Recovery plan is beyond important, if the first time they are going through the steps is when an outage occurs it will become a painful and lengthy process to get through.<\/p>\n\n\n\n
One weak link can cause the entire chain to crumble, the Colonial Pipeline outage in 2021 was caused by a compromised password for an account on their VPN that was inactive[1]. This allowed the attackers to install ransomware on the entire system, shutting down operations for 5 days while they received assistance from federal agencies. The company, overseen by the FBI, paid DarkSide $4.4 million for the ransom and received a tool that required a lengthy amount of time to restore critical systems[2]. In the following months only 84% of the bitcoin used to pay the ransom was recovered, but due to fluctuations the digital currency was worth less than when they paid the ransom[2]. This is an extremely costly loss for the company and for the Country due to the halt in operations, which could have been prevented had the CIA triad been understood and utilized.<\/p>\n\n\n\n
Why was an inactive account still accessible? Why did they not require Multi Factor authentication to gain access to the system? And why did they not have backups for their crucial systems that they could revert to after the ransomware was implemented. Luckily enough all of these points were brought up in the aftermath and companies have begun to implement more rigorous protections on crucial systems, but we need to be proactive not reactive in this modern world of Cyber Threats.<\/p>\n\n\n\n
References:<\/p>\n\n\n\n
[1]https:\/\/ieeexplore.ieee.org\/document\/10181159<\/p>\n\n\n\n
[2]https:\/\/www.cnn.com\/2021\/06\/07\/politics\/colonial-pipeline-ransomware-recovered\/index.html<\/p>\n","protected":false},"excerpt":{"rendered":"
Madison Williamson The CIA Triad is a guideline for IT groups to follow to ensure they prevent attacks or loss of information. It contains three parts, Confidentiality, Integrity, and Availability, each of which make up best practice standards. Confidentiality can be explained as keeping information that should not be shared secure and only accessible to… <\/p>\n