Information Security Concepts: Confidentiality, Integrity, Availability, and Authenticity

In information security theory we encounter the acronym CIA--which does not stand for a governmental agency--but instead for Confidentiality, Integrity, and Availability. You say, "Clemmer, why are these concepts so important?"

Well, without any one, or in fact all of them, business operations, transactions, and communications can become unreliable, untrustworthy, and uncertain. In this article series we will examine each of these concepts as IT goals, and discover how we may accomplish them. I also want to identify and add a fourth important concept: Authenticity. We may take away from this discussion a new acronym: CIAA.

This means, at the core of the concept, that the data is hidden from those that are not supposed to see it. Read more about this in my articles: Debunking The Top 10 Security Myths: 6-10, and Security Through Obscurity--Boon or Bane?

We can accomplish Confidentiality in a number of ways. These methods are complementary. First, require strong authentication for any access to data. Second, use strict access controls. In communications only the sender and intended recipient should be able to access the data. In file systems and data repositories, only the creator and intended users can access the data. Third, ensure encryption of the data so that it cannot be intercepted, and cannot be accessed during transmission or transport. Encryption is frequently what students of confidentiality think of first. While encrypting data is surely a way of keeping it confidential, it's not the only way.

Integrity as a concept means that there is resistance to alteration or substitution of data, and/or that such changes are detected and provable. The information should not be changed except by an authorized agent. This usually involves the use of checksums, one-way hashes, or other algorithmic validation of the data. Whether the data might be changed by accident or malice, preventing that change is the foremost concern, and detecting if it has changed is second. Integrity can be maintained at many levels, from the hardware all the way to the application logic.

For our data to be of use to us, it has to be accessible when and where we need it. Therefore part of the puzzle is how to keep our data available. Attacks or accidents can bring down systems. Data can be overwritten, deleted, or destroyed. Denial of Service attacks can make otherwise fast-access systems run like cold molasses.

High Availability solutions, including load balancing, fail-over, and quick backup and restoration are all involved. In my opinion these topics are network and systems architecture concerns, operations concerns, and not truly a primary security component. I think we ought to, when considering security issues, place Authenticity as a higher priority than Availability! If my data is available 24/7 but it's not the data I believed it was, then having it available is pointless.

At first glance it might seem that Authenticity is included in the concept of Integrity. Integrity is more specifically about the content of the data itself. Authenticity means that when I get an order from Bob, it's verifiably Bob that's placing the order. The order (the data) is of no value if Bob didn't want to place it. So, Authenticity involves assurance that the data was created or sent by the source it appears to be from. Not verifying authenticity is tied to current problems with spam, e-mail phishing, web site redirection, browser hijacking, or other attacks such as man-in-the-middle attacks.

Clearly these are fundamental and critical concepts. Some clients I've worked with, however, have (unfortunately) dismissed the importance of one or more of these concepts in their business. I hope that you won't. And, I hope I have made a case for the relevance and importance of Authenticity as a core concept. Next, we will examine Confidentiality more closely.