CIA & DAD Triads and Parkerian Hexad
What makes a system secure? Security is not just about preventing unauthorized access. It also involves protecting information from unauthorized modification and ensuring that systems and data remain available when needed.
These three fundamental principles are known as the CIA Triad: Confidentiality, Integrity and Availability.
CIA Triad
- Confidentiality: Ensures that information is only accessible to authorized individuals. This prevents unauthorized access to sensitive data.
- Integrity: Ensures that information remains accurate and protected from unauthorized modifications. Any unauthorized changes should be detectable.
- Availability: Ensures that systems or services are available whenever needed.
Example:
- Confidentiality: A password protects a personal account from being accessed by unauthorized individuals.
- Integrity: A student's exam grade can only be changed by authorized teachers, preventing unauthorized modifications.
- Availability: A website uses multiple servers to remain accessible even if one server fails.
DAD Triad
The DAD Triad represents the opposite of the CIA Triad. It describes three threats that compromise confidentiality, integrity, and availability:
- Disclosure: The opposite of confidentiality. Occurs when sensitive information is accessed or exposed to unauthorized individuals.
- Alteration: The opposite of Integrity. Occurs when information is modified without authorization.
- Destruction/Denial: The opposite of Availability. Occurs when information or systems are destroyed or made unavailable.
Example:
- Disclosure: An unauthorized person gains access to a patient's medical records and publicly exposes sensitive health information.
- Alteration: An attacker modifies a patient's medical records, which could lead doctors to provide incorrect treatments and potentially put the patient's health at risk.
- Destruction/Denial: A power outage causes a hospital's IT systems to shut down, preventing medical staff from accessing patient records and disrupting hospital operations.
Parkerian Hexad
The Parkerian Hexad expands on the CIA Triad by introducing three additional security attributes: Authenticity, Possession or Control and Utility.
- Authenticity: Ensures that information is genuine and originates from the claimed source.
- Possession or Control: Ensures that information is protected against unauthorized possession or control.
- Utility: Ensures that information remains usable and serves its intended purpose.
Example:
- Authenticity: An attacker sends a fraudulent email that appears to come from a trusted company.
- Possession or Control: An attacker steals an encrypted USB drive containing confidential company documents. Even without being able to read the files, the attacker gains possession of them.
- Utility: A user has access to an encrypted file but loses the decryption key, making the information unusable.
The three principles of the CIA Triad should be carefully balanced. Focusing too heavily on confidentiality and integrity can limit availability, while prioritizing availability may compromise confidentiality and integrity. Effective security requires finding a balance between the three principles.