There are lots of businesses working on the internet exposing their data and resources to a range of cyber threats.
As the data and system resources are the pillars upon which the organization works, it goes without saying that a threat to these entities is certainly a threat to the business itself.
A threat can be anywhere from a small bug in a code to a multifaceted cloud hijacking liability. Risk assessment and evaluation of the cost of reconstruction assist the organization to stay prepared & to look ahead for possible losses.
Therefore knowing and formulating the goals of cyber security particular to every organization is vital in protecting precious data.
Cybersecurity is a practice made for the protection of responsive information on the internet & on devices safeguarding them from attack, damage, or illegal access.
The goal of cybersecurity is to make sure a risk-free and secure environment for keeping the data, network & devices guarded against cyber threats. Let us learn more about the Fundamental goals of cybersecurity.
Table of Contents
What are the Fundamental Goals of Cybersecurity?
The critical goal of cybersecurity is to defend the information from being compromised. To attain this we look at 3 fundamental goals of cybersecurity.
- Protecting the data
- Preserving the reliability of data
- Restricting the accessibility of data only to approved users
Here are a few steps to sustain these goals
- Classifying the assets based on their significance & precedence. The most significant ones are kept safe at all times.
- Pinning down possible threats.
- Determining the technique of security guards for every threat
- Monitoring some breaching activities & managing data at rest and data in motion.
- Iterative maintenance and responding to some issues involved.
- Updating policies to manage risk, based on the earlier assessments.
All of the above features can be fit into 3 major goals recognized as the “CIA Triad”. So let us jump right in & get started with the CIA concepts in the next section.
What is the CIA Triad?
The CIA Triad is a safety and protection model developed to make sure the 3 goals of cybersecurity, are Confidentiality, Integrity, & Availability of data & the network.
Confidentiality measures are intended to avert sensitive information from unofficial access. Integrity is the ongoing maintenance of constancy, accuracy, and consistency of data throughout its lifecycle.
And accessibility ensures information must be constantly and willingly accessible for certified parties.
Confidentiality – Keeping important information private. Encryption services can defend your data at rest or in transit and stop unauthorized access to secluded data.
Integrity – is the stability of data, networks, & systems. This includes mitigation and practical measures to restrict unapproved changes, while also having the capability to recover data that has been lost or compromised.
Availability – refers to certified users that can generously access the systems, networks, & data required to perform their everyday tasks. Resolving hardware & software conflicts, along with standard maintenance is vital to keep systems up & available.
How do you utilize the CIA Triad? When you get a fresh application or service, ask if this will affect the confidentiality, integrity, & accessibility of the data it touches.
Focus on one leg of the triad at a time. Knowing the CIA triad will assist you to get started on your journey into cyber security.
Understanding the CIA triad
Odds are you have noticed a movement here – the CIA Triad is totally talked about information security.
While this is considered the major factor of the majority of IT protection, it supports a limited view of security that ignores other significant factors.
For instance, even though accessibility may serve to make certain you don’t lose access to resources needed to give information when it is required, thinking about information security in itself doesn’t promise that somebody else hasn’t used your hardware resources without approval.
It’s significant to know what the CIA Triad is, how it is used to plan, and also to apply a quality security policy while understanding the different principles behind it. It’s also significant to know the limitations it presents.
When you are well-versed, you can use the CIA Triad for what it has to present and avoid the consequences that might come along by not understanding it.
Here are Some Examples of the CIA Triad
To know better how the CIA Triad works in practice, suppose an ATM that let users access bank balances & other financial information. An ATM includes measures to cover the principles of the triad:
The 2FA (debit card with the PIN code) offers confidentiality before authorizing access to critical and private data.
The ATM & bank software make sure data integrity by retaining all transfer and withdrawal records made through the ATM in the user’s bank accounting.
The ATM offer availability as it is for public use & is available at all times.
Significance of the CIA Triad
Now that we have covered what the CIA is, it is time to know why it is more useful as a triad. The CIA Triad, in a means, helps make sense of the various security techniques, software, & services accessible.
Rather than a shot in the dark, it helps to obviously draw a picture of what is precisely necessary that will address the safety concerns.
The three concepts exist in apprehension with one another when it is worked as a triad.
For instance, requiring detailed authentication, in turn, helps make sure confidentiality, but at the same time, a number of people who have the right to the data might not get access, so, reducing accessibility.
As one is forming an information security policy, the CIA Triad will help make more effectual decisions on which of the three principles is most helpful for the particular set of data and for the association overall.
- Confidentiality in Cybersecurity
We have previously briefly explained what confidentiality is. In practice, it’s regarding access control for users of data to stop unauthorized activities.
This means that only those authorized can access particular assets. Unauthorized users are keenly prevented from obtaining access, so maintain privacy.
- Integrity in Cybersecurity
When one thinks of integrity, one thinks of the condition of something being whole or undivided.
But, in cyber security, integrity is all about making certain that data has not been messed with or manipulated, and therefore it is authentic, exact, and trustworthy.
For instance, in e-commerce, clients expect products, pricing, & other associated details to be accurate & that they will not be altered once the order is placed.
Equally, in banking, a sense of trust about banking information and account balances has to be recognized by ensuring that these details are genuine and have not been tampered with.
Mainly, ensuring integrity involves protecting the data at all times—in use, in transportation (sending an email, uploading or downloading files, etc.), & when stored in a storage device, data center, or cloud.
Like privacy, integrity can be compromised in special ways. It can happen directly through the intrusion of detection systems, modification of configuration files, or change of system logs to evade detection) or human errors.
- Availability in Cybersecurity
Systems, applications, & data will lose their worth if they are not available to their certified users whenever they need them.
Availability is the ease of use of networks, systems, applications, & data by certified users in a timely fashion whenever resources are necessary.
Accessibility can be compromised if there is a hardware or software breakdown, natural disasters, power failure, or human error. DDoS attacks are one of the more ordinary reasons for the breach of availability.
Availability can be made sure through network, server, application, & service idleness. Hardware fault tolerance in servers and storage is one more excellent countermeasure to keep away from violations of availability.
DoS protection solutions, system upgrades, standard software patching, complete disaster recovery plans, backups, etc. are all ways to make sure availability.
