Unit
- Confidentiality: Ensuring that information is accessible only to authorized individuals, processes, or systems. Common controls include encryption, access control lists, and data classification schemes. A breach of confidentiality occurs when sensitive data is disclosed to unintended parties.
- Integrity: Guaranteeing the accuracy and completeness of information and processing methods. Controls such as hashing, checksums, and versioning prevent unauthorized modification. Integrity failures can lead to corrupted databases, fraudulent transactions, or tampered logs.
- Availability: Ensuring that information and associated assets are accessible when needed. Redundancy, failover clusters, and DDoS protection support availability. Downtime erodes trust and may violate service-level agreements.
- Non-repudiation: Providing proof of the origin and delivery of data, preventing a party from denying an action. Digital signatures and audit trails create irrefutable records of transactions and communications.
- Defense in depth: Layering multiple independent security controls so that if one fails, others still provide protection. This principle applies across network, host, application, and physical layers to create a resilient posture.
- Least privilege: Granting users and processes only the minimum permissions necessary to perform their functions. This reduces the blast radius of compromised accounts and limits internal threats.
- Separation of duties: Dividing critical tasks among multiple individuals to prevent fraud or error. For example, the person who authorizes a payment should not also process the transaction.
- Fail safe / fail secure: Designing systems so that when a failure occurs, they default to a secure state rather than an insecure one. A firewall that crashes should block all traffic, not pass it.
- Risk management: Identifying, assessing, and prioritizing risks to information assets. Controls such as risk registers, quantitative and qualitative analysis, and risk treatment plans help organizations mitigate threats. Effective risk management ensures resources are allocated to the most critical vulnerabilities and that residual risk aligns with organizational tolerance.
- Security awareness training: Educating employees on security policies, phishing recognition, and safe computing practices. Regular training reduces human error, which is a leading cause of breaches. Simulated phishing exercises and role-based content reinforce learning and help build a culture of security vigilance.
- Incident response: A structured approach to managing security breaches. Phases include preparation, detection, containment, eradication, recovery, and lessons learned. A well-defined incident response plan minimizes damage, preserves evidence, and enables quick restoration of operations while improving future defenses.
Strategic Framework
Framework: McCumber Cube
Purpose: to analyze security across three dimensions: information states (storage, transmission, processing), security goals (confidentiality, integrity, availability), and security countermeasures (technology, policy, people).
- Information States: Data at rest (stored), data in transit (transmitted), and data in use (processed). Each state requires different controls; encryption protects at rest and in transit, while memory protections apply to data in use.
- Security Goals: The CIA triad forms the core objectives. Adding non-repudiation and accountability extends the model for legal and audit contexts.
- Countermeasures: Technology includes encryption and firewalls; policy encompasses standards and procedures; people covers training and awareness programs. The cube reminds practitioners that no single dimension suffices.
Quick Revision
- The CIA triad (Confidentiality, Integrity, Availability) is the foundational model for information security objectives.
- Non-repudiation, defense in depth, least privilege, separation of duties, and fail-safe design are core security principles.
- The McCumber Cube provides a three-dimensional view of security, ensuring coverage across states, goals, and countermeasures.
- Effective security requires balancing technical controls, robust policies, and a security-aware workforce.