All language subtitles for 002 The CIA Triad_en

Hello and welcome to the first lecture of the course, we are going to start with the CIA triad, which

stands for confidentiality, integrity and availability.

The CIA triad is used in every single domain of cybersecurity, and you must be perfectly clear about

each of the components.

Let's have a detailed look at the components of the CIA triad so C stands for confidentiality.

Now you need to be sure that your data is confidential when it is stored, when it is being transmitted

and when it is being processed.

So you need to make sure that your data is hidden and it is only visible to authorized users.

The classic way of enforcing confidentiality is through encryption.

Encryption makes your data secure so that it is not visible to unauthorized users.

Some violations of confidentiality include packet sniffing.

So that happens when your data is being transmitted over a network and somebody captures your traffic.

Confidentiality is also violated when somebody is able to successfully break the encryption that you

use to protect your data.

But it can also sometimes happen due to unintentional human error when a user inadvertently exposes

data.

The second component is integrity, which means that your data must be accurate and complete and that

it has not been modified. Typical violations of integrity happen when you transmit you data from one

point to the other and a man in the middle intercepts your traffic and modifies your data.

Integrity is typically enforced through hashes.

Hashes are a kind of summary or a message digest of your original data so that if anything changes in

your data, the hash would also change.

So at the destination, the receiver can simply check the hash to make sure that the data has not been

modified.

Typical violations of integrity include modification of data, especially during transit. The last

component is availability, which means that data is available as and when required.

Violations of availability happen if someone, for example, damages your communication infrastructure

or they damage your Web server so that you're no longer able to service your clients.

However, even if someone successfully slows down your database servers or your Web servers so that

they cannot service the clients in an appropriate amount of time, then this would also be considered

a violation of the availability.

Typically, availability is enforced through redundancy.

What it means is that you install multiple communication links or for example, you install multiple

Web servers so that even if some of the communication links or some of the Web servers, they are targeted,

you still have some backups.

Let's discuss confidentiality in more detail, so as we discussed, confidentiality refers to protecting

or hiding your data so that it is available only to authorized users.

Now, the Internet is a public network which is very insecure.

So if you're sending your data in plain text over the public Internet or even any other public network,

then it means that there's a good chance that people can eavesdrop on your data, which is in plain

text.

And this would constitute as a violation of the confidentiality of the data because now it is available

to people who are not authorized.

The classic way of enforcing confidentiality is by encrypting your data.

So what encryption does is that you give it a secret key and the encryption algorithm takes the data

and uses the key to encode the data into a format which is not understandable by anyone.

So even if somebody gets a hold of a copy of your data, they would not be able to decode this data

easily.

And this provides significant benefits in comparison to sending your data in plain text.

So this is the main idea of confidentiality.

You want to make sure that your data is encrypted.

It is in a format that even if it is compromised, you still have a reasonable certainty that it would

not be easily broken.

Let's discuss integrity in more detail, as discussed previously, integrity means that your data is

accurate, complete and unmodified, especially when it is being transmitted over networks.

A classic violation of integrity happens when you're sending your data from point A to B. But a man

in the middle intercepts it, changes it, and then sends the modified copy to the destination.

Now, the problem is that the source and the destination don't have perfect visibility.

And it is very easy for man in the middle to leverage this lack of visibility in order to replay packets

after modification.

Now, in this case, the integrity of your data has been violated because the file that you have received

is not exactly the same that was sent by the source.

Traditionally, integrity is enforced by using hashes, so a hash is kind of a summary or a message

digest of your main file, which means that you calculate sort of a summary of your main file or main

data and then you encrypt it using a secret key.

Now you send the file along with the hash to the destination.

And even if a man in the middle changes your file, when your file reaches the destination along with

the hash, the destination is going to independently calculate the hash of this file.

So the destination is going to do its own calculations and then he's going to compare the two hashes.

If there has been any modification in the file compared to the original file, the two hashes won't

match.

And this is how the destination would be able to detect that there has been a compromise of the integrity

of the file.

Let's discuss availability in more detail, as discussed previously, availability basically means that

your data must be available as and when required.

Malicious attackers can damage the availability of your infrastructure data or your applications in

a number of ways.

They may attack communication links between clients and your servers, making it difficult or impossible

to reach your servers or they may directly attack your web or application servers.

Now, please note that the attack can be partial so the attacker doesn't need to completely break off

the communication link so the attacker can simply choke communication links enough so that the traffic

is very slow or they send so much traffic to your servers that they are very slow at responding to

legitimate clients.

The classic way of enforcing availability is by using redundancy.

So, for example, if you have multiple Web and database servers, even if some of your servers go down

or the attacker sends excessive traffic to them, we can simply load balance and ensure availability.

Similarly, we can also employ multiple communication links and so on. So that concludes our lecture

on CIA.

Please remember that the CIA triad is of paramount importance in cybersecurity and will be using these

terms throughout the course.

I'll see you in the next lecture.