This Article is about the importance of the CIA Triad, what it is, and what’s it about. Additionally providing the difference between Authentication & Authorization. What Confidentiality, Integrity, and Accountability, has to do with Cyber security. Defining Authentication and Authorization in cybersecurity.
CIA Triad, What it is and What it’s about
CIA Triad is a set of rules that companies should follow. This CIA Triad can be confused with the Central Intelligence Agency, unfortunately this has nothing to do with that agency. The reason they should follow these rules is to be able to protect their company or organization from data being tampered with. The data that you are storing or transferring is what you are storing and or transferring. It’s available all the time to anyone who’s responsible for the data at any time. [5]
C in CIA stands for Confidentiality. This means that only specific people and computers may look at sensitive or classified information. [1][2][5]How a computer is allowed to see specific sensitive or classified information is through encryption. This key to a lock box, however this key to the lock box is so unique that it can only be used by you because it was magically enchanted for it to only work with your touch.
I in CIA Triad stand for Integrity. Imagine someone is handing you a pencil, however, they break that pencil while handing it to you. Is it still considered a pencil or is it now a broken pencil? That is what integrity means for a computer they make sure that the “pencil” the computer has received is a pencil.
Availability in CIA Triad. Availability means you would like to go to Walmart at two in the morning, but you can’t because the store got robbed and now, they have closed the store down because of the robber. This implies that a computer must be available at any time. You must make sure that nothing is able to disrupt the service of the computer. What all this means is being able to handle and manage all these tasks in your organization.
What CIA Triad has to do with cyber security
How this has to do with cyber security is who is responsible for these tasks. There must be a way to identify, protect, detect, respond, and recover the data if any of these rules are broken. The course of action they must take, and the risk assessment that’s involved with this responsibility. [1]
Defining Authentication and Authorization
The definition of authorization from NIST CSRC website defines is “The right or a permission that is granted to a system entity to access a system resource.”[4] Also, as “Access privileges granted to a user, program, or process or the act of granting those privileges.” [4] This means only people, or computers you allow, will be able to use those computers.
The definition of authenticate from NIST CSRC website defines it as “Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in a system.” [3] Including as “Security measures designed to establish the validity of a transmission, message, or originator, or a means of verifying an individual’s authorization to receive specific categories of information.” [3] In short, how do I know you are, who you are. A computer does this in a multitude of ways, but for the computer to know who you are is through multiple methods. Like two-factor authentication, biometric, security tokens, key fobs and other multitude of ways for a computer to know it’s you.
The difference between Authentication and Authorization
There is a big difference between authentication and authorization. As explained earlier, authentication is for a computer to verify that it is you. Authorization is having the permission to even be able to use that computer. A good example of this is you have a car with two car keys. You lend one of your friends borrow your car to go to the store. You authorized him to use the car. The car authenticated them by using the car keys.
Personal Takes on CIA Triad, and Authentication and Authorization
The CIA Triad is important having confidentiality is important to have specific personnel be able to access specific devices and having computers that don’t have to be involved in that network to not communicate with it to potentially cause issues down the line. As stated from the NIST website “preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information”. Integrity is also a key role in this, due to it keeping the data that is stored and transferred from computer to computer save from it being changed. As stated from the site itself “guarding against improper information modification or destruction and ensuring information non-repudiation and authenticity” as important confidentiality and integrity is, just as important as availability is to this role. Being able to access data 24/7 is crucial to operations. If someone need to access that information it is available to them right there and then when they need it the most. Knowing the difference between Authentication and Authorization is crucial, but it is very easy to mix the two. Authentication is the act of a device verifying it is you who is accessing the device itself through forms of authentication. Authorization is the device itself confirming that you are allowed to even use the device. As an example from earlier best explains it. Lending a car to a friend where you authorize them to use it, and when they go to use the car, the car confirms it by using the key.
Citation
https://www.nccoe.nist.gov/publication/1800-25/VolA/index.html [1] https://www.geeksforgeeks.org/the-cia-triad-in-cryptography/ [2] https://csrc.nist.gov/glossary/term/authenticate [3] https://csrc.nist.gov/glossary/term/authorization [4] https://drive.google.com/file/d/1898r4pGpKHN6bmKcwlxPdVZpCC6Moy8l/view [5]