All language subtitles for 04. CIA model

Welcome to the introduction to CIA lecture. To better define the different types of security threats and how
1

to protect against them, a model called CIA has been created.
2

The CIA model is also known as the CIA triad.
3

What does CIA stand for?
4

And no, in this case, it does not stand for Central Intelligence Agency in cybersecurity. CIA stands
5

for Confidentiality, Integrity and Availability.
6

In the next slides, we will go in more detail regarding each element.
7

Let's start with confidentiality.
8

Confidentiality is the property that information is available only to authorized individuals, entities
9

or processes.
10

Confidentiality basically refers to protecting information from being accessed by unauthorized parties,
11

a failure to maintain confidentiality is commonly known as a breach.
12

Most of the time, once there is a breach, it cannot be remedied.
13

For example, if private emails are leaked publicly online, we have a breach, and unauthorized parties
14

have already accessed and read the information.
15

We cannot do anything to make the unauthorized people unread the emails they already read.
16

Let's see a few examples where confidentiality is important.
17

Let's start with health and insurance. For example.
18

your medical records are private and only authorized
19

people should be able to access them, such as, for example, you and your doctor.
20

Another domain is financial services. Your transactions and balances should be private.
21

Also, you would not want your credit card to be public.
22

Yet another example is messaging and social media. Your messages, emails, and social media should be
23

private.
24

Only you and the people that you want to share the information with should have access to that information.
25

And finally, confidentiality is important in everyday use.
26

Data that you store on your personal devices, such as your smartphone or laptop is confidential.
27

This data should only be accessible to you even if your device is stolen.
28

Now that we understood what confidentiality is, let's have a look at some common ways to ensure it first.
29

We can do this by encrypting sensitive files.
30

For example, your hard drive should be encrypted.
31

So, even in the event that your device is stolen, the data is not accessible by anyone else.
32

Another example can be, encrypting data stored online, such as in the cloud, so that it's only available
33

to authorized parties.
34

Another way to ensure confidentiality is to communicate over secure channels.
35

This can apply to messaging tools, for example.
36

Ideally, you should use apps like Signal or WhatsApp that provide end-to-end encryption.
37

End-to-end encryption means that the message is encrypted by the sender and only the receiver can decrypt it.
38

.
39

This way, the message can travel safely without the fear of eavesdropping.
40

Next, we have data access management.
41

This basically means providing access to the data only to authorise parties.
42

For example, let's take a personal computer that has multiple users. In order to make sure that my personal
43

data is not accessible to other users,
44

I must get the permission to access my files only to myself.
45

No other user should be able to access my file.
46

Finally, in order to safeguard confidentiality, devices and documents should be secured.
47

This basically translates to not leaving your device or documents unattended in a public space.
48

Also, you should never, ever keep your passwords written in spaces that are accessible by others,
49

such as, for example, your workdesk.
50

You can have the most secure passwords in the world, but if you have them written on sticky notes
51

on your desk, it's all for nothing.
52

Before we move on, please note that multiple methods discussed in this slide can be used at the same
53

time to guarantee confidentiality.
54

After confidentiality, let's discuss about integrity.
55

Integrity refers to ensuring authenticity of information.
56

This basically means that information is not altered and that the source of the information is genuine.
57

Again,
58

let's have a look at a few examples where integrity is important.
59

Let's start with health and insurance.
60

Think of an app that contains your medical records.
61

You definitely don't want your medical records to be unreliable and have different data
62

each time you open your app. You want to know that your data is correct and filled in by a trusted
63

source such as, for example, your doctor.
64

Next example is financial services.
65

Your bank account must not be altered by anyone.
66

Nobody wants to have an empty account out of the blue.
67

Another domain where integrity is important is automotive.
68

For example, the speedometer of the car should be trusted, so, it must always be accurate.
69

You don't get the speeding fine just because your speedometer was inaccurate.
70

Yet another example can be messaging and social media. Integrity must be enforced for posts and messages
71

on social media.
72

Otherwise, people could impersonate you and write or change messages on your behalf.
73

Last but not least, integrity is important in everyday use.
74

Whenever we surf the web, for example, reading news on our favorite news site or watching some movie
75

on a streaming service.
76

We need to know that the new site or streaming service do not content altered content and that the
77

information is genuine.
78

Now that we know what integrity is, let's see some ways it can be insured. One way is by using checksums
79

A checksum is a value that is computed based on data.
80

This value is used to detect if errors have been introduced during the transmission or storage of the
81

data. For example, messenger applications can use checksums to validate whether the message received
82

contains errors or not.
83

Another, more powerful way to enforce integrity is to use a digital signature. A digital signature is
84

a mathematical algorithm that is used to validate the authenticity and integrity of a message.
85

So, for example, each message that is being sent in a messenger can be digitally signed, guaranteeing
86

that it has been sent by a specific person, and that its content is genuine.
87

Next, we can use backups and redundancies to make sure that our precious information maintains integrity.
88

Think of your personal data stored on your PC.
89

If the storage suffers a hardware failure or the device gets stolen, all your data will be gone.
90

But, if you have a backup, you can easily restore the lost data.
91

Another example can be a website, such as an online forum.
92

The server on which the forum is hosted can fail at some point due to a hardware failure
93

risking to corrupt and/or lose the data. To protect against these frequent backups can be done.
94

Also, adding extra servers that host the online forum can help mitigate the risk of losing data.
95

A version control system is a system that contains the current as well as previous versions of files,
96

documents or programs, and can be used to track changes down to the aforementioned files, documents
97

or programs.
98

Last but not least, file permissions and access control can help ensure integrity.
99

Basically, this means making sure that only parties that should modify or delete the data are able
100

to do so.
101

For example, let's imagine an online school schedule shared on Google Drive.
102

The content of the school schedule should be accessible to everyone, both students and teachers, but
103

should only be modified by the teachers.
104

So, the teachers should give permission to view the file to everyone, but permission to edit only to
105

the teachers. Before we move on
106

please note that multiple methods discussed in this slide can be used in conjunction to guarantee the integrity
107

of information.
108

Until now, we covered the confidentiality and integrity.
109

It's now time to have a look at the last element of the CIA triad.
110

IT Availability.
111

Availability means that information is accessible by authorized parties whenever desired.
112

This applies to all I.T. systems, from all the services that we use online, such as, for example,
113

video streaming platforms, online banking, social media platforms, and websites in general, to the usage
114

of our own laptop or smartphone.
115

All these services should be available to their users whenever the users demand them.
116

Let's have a look at a few ways in which we can ensure availability.
117

First, we have redundancy.
118

We already discussed a bit about it when we looked at ways to ensure integrity.
119

Similarly, redundancy could also be used to ensure availability.
120

Nowadays, most services use redundancy to guarantee availability.
121

For example, a streaming platform can have multiple instances deployed on separate servers so that
122

if one of them goes down the service
123

the service is not impacted.
124

For example, a streaming platform can have multiple instances deployed on separate servers,
125

so, in case that one of the servers goes down, the service is not impacted.
126

Also, since one server cannot serve unlimited customers,
127

hosting the service on multiple servers can ensure availability even when a large number of users are
128

using the service at the same time.
129

Next, we have backup, which goes hand in hand with redundancy, having data stored in multiple places
130

can help guarantee availability. To continue with the streaming example, having a movie backed up and
131

stored on multiple servers can allow the movie to be streamed even when one of the servers is down, due
132

to, for example, a hardware failure.
133

Last but not least, is lifecycle management.
134

All hardware will eventually fail.
135

Because of that, we should plan the replacement of older hardware, which can make the infrastructure
136

more reliable and provide improved availability.
137

The same lifecycle management can be applied to software, replacing older software with newer software.
138

To recap, in this lecture, we learned what the CIA triad is, and for each of its element, Confidentiality,
139

Integrity and Availability,
140

we had a closer look and learned how we can ensure them.
141

With that, we conclude this lecture. As always, if you have any questions, don't hesitate to ask us.
142

See you soon in the next one.