How to Understand and Use the CIA Triad Model in Cybersecurity

Introduction to the CIA Triad Model

Confidentiality, Integrity and Availability, also known as the CIA Triad, is a model that was developed to implement information security policies within an organization. It can also be called the AIC Triad to avoid being mistaken for the US Central Intelligence Agency.

In this model, “confidentiality” means the restrictions put in place to make sure that data or information is accessible to only certain individuals in a company. “Integrity” is the guarantee that the information is reliable and accurate, and that it cannot be altered in an unauthorized manner. “Availability” is the uninterrupted access to the information by authorized individuals as needed. These three principles together make up the CIA Triad.

Background and History of the CIA Triad

The concept of Information Security, or cybersecurity, was not in existence in the 1950s or 1960s. Security then was all about protecting and guarding expensive computers and limiting physical access to them.

As hardware and software development continued to progress in the 1970s, there was a shift in focus from computer security to information security.

During this period, ARPANET was still in its early years, and the US Department of Defense commissioned a study published by the Rand Corporation as “Security Controls for Computer Systems.” It pointed out many potential threats and possible security measures that were needed at that time. This report came to be known as the Ware Report.

In the 1980s, there was a switch from confidentiality to commercial issues that focused on costs and business risks. Of these, integrity became a vital concept for both businesses and financial institutions to prevent data being tampered with by unauthorized entities. In 1988, the Morris Worm became the first DoS attack on the Internet. It was then that availability became recognized as an essential aspect of information security.

By 1998, people saw the three concepts together as the CIA Triad.

Elements in the CIA Triad Model

• Confidentiality simply entails privacy. Confidentiality is the ability to protect data from those not authorized to view it. It prevents illegitimate access to sensitive information. A good example of confidentiality is the personal information of an e-commerce store. Sensitive information like credit card details, contact information, and other personal information of e-commerce store users needs to be secured in order to prevent illegal access and exposure. Violation of confidentiality can happen in many ways, including through direct attacks, human faults, and electronic eavesdropping.
• Integrity has to do with the consistency, accuracy and trustworthiness of data over its entire lifecycle. Data should not be altered while it is still being processed, and steps must be taken to ensure not only that unwanted changes to data are prevented, but also can be reversed when they occur. For instance, if an attacker alters sensitive medical data belonging to a patient, it is possible that a doctor could prescribe the wrong treatment, which would have a negative effect on the health of the patient.
• Availability is the ability to ensure that information is consistently accessible when needed by authorized parties. This involves proper maintenance of hardware and technical infrastructure of systems that store and output this information. Certain issues that may cause non-availability of information are power loss or outage, operating system or application problems, storage failures, natural disasters or even human errors. Denial of service attacks (DoS) are the most common problems that threaten the availability of information.

Cases and Instances Where the CIA Triad Is Used

Confidentiality: A good example of methods used to ensure confidentiality are authentication mechanisms, data encryption, and user ids and passwords with two-factor authentication (2FA), a standard procedure that is gradually becoming the norm. Other options include biometric verification, security tokens, and cryptographic keys.

Integrity: This include file permissions and user access controls. Version control can be used to avoid situations where changes made in error or mistakes made by authorized users can become a problem. Data can also include checksums, or even cryptographic checksums, for verification of integrity. Also, digital signatures can further be used to provide certain effective measures to ensure that an individual cannot be denied actions like sending messages and viewing or sending documents.

Availability: There are various ways to ensure the availability of information. Some of them are ensuring network servers are always up and running, monitoring bandwidth usage, system upgrades, regular software patching, and providing disaster recovery plans and backups if systems go down, etc. These are all methods that adhere to the availability principle of the CIA Triad.

The Importance of the CIA Triad

The CIA Triad is the guiding principle for the development of security systems in organizations. The CIA Triad plays a crucial role in keeping information safe and secure against cyberthreats and risks. When information theft or a security breach occurs, it often implies that an organization has been unsuccessful in implementing one or more of these principles in the CIA Triad. It is detrimental for an organization when GDPR (General Data Protection Regulation) is violated.

However, depending on the organization’s security priorities or industry regulatory requirements, or even the nature of the business the organization is in, one of these principles may take priority over others.

For instance, in government agencies or financial institutions, integrity may take priority over confidentiality and availability. Availability of information is critical in e-commerce and healthcare sectors. However, there may be a trade-off in prioritizing one of the principles over others. But in all, organizations have to employ the aforementioned security controls to enhance their cybersecurity posture.

Challenges Faced by the CIA Triad

Internet of Things (IoT) Security

This is a major challenge as every year, there is an increasing rate of growth in the number of internet-enabled devices in the market. The Internet of Things (IoT) allows physical objects or “things” to collect and exchange information, and it is prone to security risks. Sometimes, many of these devices have software that is easy to hack and have very weak security passwords. While some of these devices do not transmit sensitive information, it is possible for a hacker to get enough information. Therefore, IoT devices create potential entrance for these hackers to perform their exploits. If adequate security mechanisms are not in place, an IoT could be used as a separate attack vector or part of a thingbot.

Internet of Things (IoT) Privacy

Almost any physical entity or object that can be given a unique identifier and has the ability to communicate autonomously over the internet or a local network is prone to attacks that can potentially expose private information. IoT devices are usually embedded with low power and low memory processors that limit the ability to process information at high speeds, which hinders the effort to maintain confidentiality and integrity in IoT systems. Digital signatures through public key infrastructure can help to mitigate these risks in IoT systems.

Big Data

Big data presents a significant challenge to the CIA paradigm because of the ever increasing amount of data that needs to be protected. As technology advances, more devices are added to the growing volume of data in different formats. Also, because the main purpose of handling big data is often to collect and interpret the information, responsible data oversight is often lacking. This issue was brought to a public forum when whistleblower Edward Snowden disclosed information on the National Security Agency's collection of massive volumes of American citizens' personal data in the United States.

Best Practices for Implementing the CIA Triad

The CIA Triad in Cybersecurity

The main entrance for cyber risks and threats is the internet network. Inbound traffic can be riddled with potential malware and social engineering schemes, while outbound traffic that is not properly controlled can lead users to insecure websites and expose an organization to malicious attacks.

Protecting an organization's network and all related devices with advanced network security solutions is a necessary action for achieving the CIA Triad in an organization.

Built-in monitoring software paired with hardware firewalls can enable individuals in an organization to stay secure online no matter what they are doing when they are making use of the internet. Continuous monitoring, testing, and reporting in a single network protection solution is crucial if an organization is to ensure the integrity of data, as well as overall business security.

The CIA Triad in ISO 27001

ISO 27001 is a framework in information security that helps organizations keep information assets secure. The CIA Triad is a guiding principle of ISO 27001. Other security frameworks like SOC 2 and PCI DSS are also built around the CIA principles. ISO 27001 includes a risk assessment process, organizational structure, access control mechanisms, information security policies, procedures, monitoring and reporting guidelines.

During risk assessments and access control mechanisms, organizations measure the risks, threats and vulnerabilities that could compromise the confidentiality, integrity and availability of their systems and data. By implementing security controls to mitigate those risks, they satisfy one or more of the CIA Triad’s principles.

Conclusion

When an organization maps out a security program, the CIA Triad can serve as a useful yardstick that justifies the need to consider security controls. All security actions inevitably lead back to one or more of the three principles. The strategic management implications of using the CIA Triad include developing appropriate mechanisms and processes that prioritize the security of customer information. The CIA Triad’s application in business also requires regular monitoring and updating of important information systems in order to minimize security vulnerabilities, and to optimize the capabilities that support the CIA components.

Resources

• Andress, J. (2014). The Basics of Information Security: Understanding the Fundamentals of InfoSec in Theory and Practice.
• Syngress, Evans, D., Bond, P., & Bement, A. (2004). Standards for Security Categorization of Federal Information and Information Systems. National Institute of Standards and Technology, Computer Security Resource Center.
• Shabtai, A., Elovici, Y., & Rokach, L. (2012). Introduction to Information Security. In A Survey of Data Leakage Detection and Prevention Solutions (pp. 1-4). Springer US.
• BITAG. 2016. “Internet of Things (IoT) Security and Privacy Recommendations.” BITAG Broadband Internet Technical Advisory Group, November 2016.
• Meola, Andrew. 2016. “Automotive Industry Trends: IoT Connected Smart Cars & Vehicles – Business Insider.” Accessed July 4, 2017.