The CIA Triad, how to keep your data safe

    The CIA Triad stands for Confidentiality, Integrity, and Availability. Confidentiality means that access to data is restricted to only those who should be able to access it. Integrity means that the data is protected from modification except by those who should be able to modify it. Availability means that the data is available at all times to those who should be able to access it. The CIA Triad is implemented at 4 different levels, from largest to smallest: organization, network, application, and end user. 

To implement the CIA Triad at the Organizational Level:

• Security strategy 
    You need a risk based security strategy to minimize the impact of an incident.

• Risk assessment
    You need to assess security-related risks from both internal and external threats.

• Disaster recovery 
    You need to ensure data is available with a disaster recovery plan.

• Security policies
    A security policy defines an organization’s security requirements.

• Security audit 
You need to evaluate your security policies.

• Regulatory standards
    Your organization may be required to comply with standards of external parties.

• Security dashboard compliance 
    Use security dashboard software to display performance.

To implement the CIA Triad at the Network Level:

• Authentication methods 
You must authenticate users attempting to access the network.

• Firewall 
Use a system that stands guard between a network and the internet.

• Routers 
Configure your routers to distinguish legitimate traffic.

• Encryption 
Scramble your data in a way that only authorized parties can read it.

• Proxy servers-VPN 
Prevent employees from accessing certain sites by using a proxy.

• Intrusion detection system
An IDS monitors resources and notifies security personnel of a breach.

To implement the CIA Triad at the Application Level:

• Authentication methods 
    Have your applications require passwords and two-factor authentication.

• User roles and accounts 
    Implement the Rule of Least Privilege so employees only access what they should.

• Data encryption
    Applications should encrypt your data to protect it.

To implement the CIA Triad at the End User Level:

• Security education 
    Users are the cause of most security breaches. Educate them. 

• Authentication methods 
    Make sure users don’t bypass authentication, like passwords on a sticky note.

• Antivirus software 
    Make users keep their antivirus up to date and install security patches.

• Data encryption
    Make sure users respect encryption policies and encrypt their data.

    In conclusion, the CIA Triad is adaptable to many different situations because the principles of it are just basic common sense. Keep your data confidential, maintain integrity, and keep the data available. As long as you keep these priorities in mind when you implement a new project, you can create policies that will keep your data safe.

Source:

Reynolds, George. Ethics in Information Technology. 6th ed., Cengage Learning, 2018