Most security books start with the basics of security by featuring the CIA triad—this is a model designed to guide policies for information security within an organization. It is a widely used security model and it stands for confidentiality, integrity, and availability, the three key principles that should be used to guarantee having a secure system:
Figure 1: CIA triad
We'll discuss these principles in more depth here:
- Confidentiality: Prevents the disclosure of data to unauthorized people so that only authorized people have access to data, this is known as the need to know basis. Only those who should know the contents should be given access. An example would be that your medical history is only available to your doctor and nobody else.
We also tend to encrypt data to keep it confidential. There are two types of encryption known as symmetric and asymmetric. Symmetric encryption uses one key known as the private key or shared key. Asymmetric encryption uses two keys known as private key and the public key.
- Integrity: This means that you know that data has not been altered or tampered with. We use a technique called hashing that takes the data and converts it into a numerical value. If you run the hash when you suspect changes have taken place, and if the numerical value has changed, then the data has been tampered with. Common hashing algorithms in the exam are Secure Hash Algorithm version 1 (SHA1) and Message Digest version 5 (MD5).
- Availability: Availability could be using Redundant Array of Independent Disks (RAID) disks or maybe fail-over clustering. Availability ensures that data is always available; an example would be if you wanted to purchase an airplane ticket and the system came back with an error and you could not purchase it, this could be frustrating.