Understanding the CIA Triad: Key Concepts in Computer Security

[Music] hello everyone welcome back in today's lecture we will

see the cia triad as usual we will start the session with the outcomes

upon the completion of this session the learner will be able to outcome number one we will define

computer security outcome number two we will know the key objectives of computer security

outcome number three we will understand the c i a triad and outcome number four we will

know various levels of impact of security breach before we step into the cia triad

let's see the definition of computer security the computer security definition is as follows the protection

afforded to an automated information system in order to attain the applicable

objectives of preserving the integrity availability and confidentiality of

information system resources which includes hardware software firmware information or data

and telecommunications and this is the definition of computer security by nist which is a government organization

of the united states i know you will find many key terms in the definition

i will just provide you an easy way to understand this definition let's figure out the three important key

terms of the definition number one the integrity number two the availability

and number three confidentiality if we understand all these three key terms then the definition will be easy

ultimately we are going to provide security to the system the system includes both hardware and

software not only hardware and software we should also focus on the firmwares or the data or the information that is

processed by the system and not only this the telecommunications as well

what is telecommunications it is the communication at a distance so in this subject we are

going to focus on security in all aspects of the computer networks

and obviously computer networks has a lot of things to deal with if these three key objectives are clear

that is the integrity availability and confidentiality that the definition will be clear

anyway we are going to see these three key terms elaborately in the cia triad part let's now step

into the cia triad what is the cia triad the name itself says that it is a triad tri means three

so there are three key elements of this c i a triad let's see what are the three key

elements we can see the first element is the confidentiality the second one is the integrity and the

third one is the availability and we can notice that everything is for the data and the

services we are going to do with the computer system all right let's see the key terms

elaborately firstly we will focus on the first key element the confidentiality when we say

something is confidential what do you mean by that it means others should not understand

except the parties who are involved in that transaction say if i am drafting a letter to my

friend and if i mention that it is confidential this confidential message means it

should be known to me as well as to my friend right because these two parties are legitimate parties

involved in this transaction now if an anonymous person receives this letter or message

and if he sees the message or the content what is there in the transaction then ultimately there is loss of privacy

right so obviously we don't have any confidentiality when somebody sees the message

so we need to prevent unauthorized access and disclosure unauthorized access means nobody else

can access except the right entities who are involved in the transaction and

disclosure means the message should not be open enough to be simple if the message is encrypted

no one else can see what is the message except the sender and the receiver right because the sender and the receiver only

will know what is the message what is the key what is the encryption algorithm everything right

generally encryption algorithms are kept public and keys only are kept secret anyway i will talk about

this later for time being just understand confidentiality means we need to protect

the data that is being transmitted if it is encrypted obviously it provides confidentiality because

no one else can see what it is right it is a scrambled text that they are seeing no one else should be able to understand

what is the message that is being transmitted between the sender and the receiver

this is exactly confidentiality let's come to the second key element in cia triad which is the integrity i

will just give you a formula like this sent is equal to received whatever the sender is sending

the same message only the receiver should receive for example if you are performing a banking transaction of 1000

rupees obviously the transaction should involve only 1 000 rupees

what if an attacker modifies this as 10 000 rupees not only the modification of amount by

the attacker let's assume the destination address or the destination account is given

as the attacker's account just imagine this for an example this may not be real and this may not be seeming to be a

perfect example but i wanted to make you to understand the severity of modification of message

i wanted to explain you what is integrity so we don't want any modification of messages by the

unauthorized people say you want to transfer some fund to your friend but unfortunately the fund

is being transmitted or transferred to somebody else account that is attackers account obviously this has

happened because of the modification of the messages that is being transmitted between the sender and the

receiver by the attackers so this transaction should not be permitted by the system

and the security system should be able to find out that this is not the message that was sent by the sender

in other words the security system should ensure that this is not the transaction that was initiated by the

sender so integrity means we need to ensure that there is no modification of the

message that is being transmitted so whatever the sender is sending that only the receiver should receive

and if there is any modification in the message that is being transmitted the system should be able to find out that

and it should discard that message so integrity is also one of the key terms of the cia triad

and coming to the third key element which is the availability availability means we need to ensure the

timely and the reliable access to the system say for example if you are hitting

google.com if you hit now it will work if you hit after one hour it will work if you hit after 10 days it will work

because you trust that google server will be always available at the same time there may be many

attacks that may be launched against google.com server but still google server is a very

secured one and google is able to provide its service to the customers or the users who access it

without any flaws so that's the power of a security system i will also provide you one more

example imagine you have a bank account and you want to access your banking server

you are expecting the banking server to respond you with the requested data what if an attacker has launched an

attack on the banking server and disrupted the service so when you access the banking server you are not

getting the service that you are expecting obviously we don't encourage that

because whenever we want a service we expect the system to provide service to us

and this service should be a timely and a reliable service as well there will be attackers always on the

internet and our security system is expected to provide security to the system

and to the users and whenever any attack is launched on the server we expect the server should withstand

that attack it should still be able to provide access to the servers in the same way as it was in the perfect

situation and that's it about the cia triad let's now navigate to the levels of impact

of security breach when there is a security breach in the organizational data or to the

server or to an individual basically there will be three levels of impact number one

is the low level impact number two is the medium level impact and number three is the high level

impact we will see the various levels of impact of security breach one by one now firstly we will focus on low level

impact if your system is affected by some attacks and the low level impact means there is

a limited adverse effect on organizations operation or organizational assets or

individual that is the system is affected with minor harm or minor damage or in terms of

financial aspects it is a minor financial loss if the effect of the attack is negligible then

it falls in the low level impact and coming to the next level of impact which is the medium level of impact

it has a serious adverse effect on organizational operation or organizational assets or even serious

adverse effect on individual so the loss may be a significant loss or a significant damage

or a significant harm that is caused to the organization or to the individual and this medium level of impact means

the attack may be involving in the loss of life or even serious life threatening issues

also and coming to the final level of impact which is the high level impact

so when the medium itself is very dangerous think about the high level impact so everything is gone

right so the reputation everything high level impact of security breach means the organization

has catastrophic adverse effect it means severe adverse effect on organizational operations or organizational assets or

individual it is a complete disaster to the organization so these are the three levels of impact

of security breach and this could be for an individual or for an organization

or for an organizational data or for the information system or for any kind of stuff that really

needs security before we step out let's see the additional features of cia triad

basically the cia triad includes only three key elements right the confidentiality

the integrity and the availability we also have two more additional elements and the additional elements are number

one the authenticity and number two accountability authenticity is the property of being genuine and being able

to verify the part is involved say if the sender is going to send some message to the receiver

say if the receiver is receiving a message and the receiver should be able to verify that the message is from the

right party or the message is from the trusted source we will call this property as

authenticity in other words let's say you are accessing google.com suppose if you give a request from your

browser as www.google.com and you are expecting that your request is going to google server and not any

bogus server right when the request is received by google server and google should be able

to verify that it is from you so this is we call as authentication or authenticity

and coming to the next additional element which is accountability say for example accountability is also

an essential part of an information security plan it means every individual who works with

an organization or who works with an information system should have specific responsibilities

for information assurance every user who access the system has their own roles and

responsibilities and whatever the actions the users perform the system should keep records

of their activities why system should keep track of the activities because

later if any attack is launched or if we find that something is suspicious then the system should permit forensic

analysis later to trace the security breaches so in order to do that we need to ensure that

the system is accountable every user is given some responsibility

and every user should access only to that level of privilege or it must ensure that the users are not

misusing their privileges let's see some real time examples for confidentiality

integrity and availability the first one we will see is confidentiality for example the

banking account information say you have your mobile phone and you have your banking

app in your mobile phone if you request some data from your banking server and from the banking server to your

mobile phone or to your desktop from where you are going to access the data traffic must be encrypted what

if the data is not encrypted obviously there are chances for the attackers to see what information is

being transferred between the sender and the receiver so we don't encourage that should happen

so encryption is one of the ways we can achieve confidentiality if the message is

encrypted except the server and you who are accessing the system

no one else can understand what it is so the message must be encrypted encryption is one of the ways to achieve

confidentiality coming to the second example which is integrity the patient's information

say for example there is a hospital management system let's assume someone is having some disease and that person

is installed with some sensors and the sensors are installed on his body in this hospital management system

the doctor can be anywhere in the world and the patient can also be anywhere in the world but still doctor and patient

relationship can exist seamlessly because of the powerful internet connectivity and the

iot concepts the internet of things in this example the patient is wearing a sensor and the patient or doctor need

not be in person to do the medical treatment or to get the medical treatment

and what is the role of the sensor you know the sensor is going to report the heartbeat rate periodically to the

doctor by other servers let's assume the server is going to collect all the heartbeat

information that is sent by the sensor so obviously whatever the sensor is sensing the heartbeat value that should

be stored without any alteration in the server only then the doctor will be able to

provide right treatment to the patient if the sensor is sensing the right value and the right value is sent to the

server but during the travel if an attacker is modifying the value

and if this modification is stored in the server and when the doctor sees this modified value and

is giving some treatment based on this this could be a life threatening issue also it could

even lead to lethality or fatality let's assume the heartbeat value that is sensed by the sensor is 70

and this 70 is now being transmitted to the receiver that is the server what if the attackers captures this

packet and modifies it as 150. so the treatment may go wrong right because of this so all patients

information must be confidential and not only confidential it should also have the property of

integrity so whatever the sender is sending that only the receiver should receive

no modification should be permitted so this is an example for integrity and coming to the next one the

availability example authentication service let's assume there is a server which is providing

authentication service and whenever user wants to carry out any activity this user must be verified or

authenticated by the authentication server and this authentication server should be

always available because user may request data access at any point of time so authentication

is one of the important services that should be always available we can take google as an example also

just think anytime you access google.com you will be able to get the access because google.com server is available

all the time and whenever you request any service you should get that service that's what as

an end user we will expect right the examples that are shown here just for understanding concepts but in

reality every application or every organization has their own set of policies

their confidentiality level or their confidentiality need will be different from each other say for example the

integrity requirement or the availability requirement or the confidentiality requirement

for every individual or an organization varies so it has to be followed as per the policies they frame

i hope these examples will help you to understand what is confidentiality integrity and availability and that's it

guys i hope now you understood the computer security the key objectives of computer security

we also understood the cia triad and we also have seen various levels of impact of security breach

i hope you guys enjoyed today's lecture i'll see you in the next lecture and thank you for watching