slide modulo 3 CIANA

The letters in "CIANA" stand for

• Confidentiality
• Integrity
• Availability
• Non- Repudiation
• Authenticity

It is a model that can be used for

• the development of security systems
• measurement of the impact of an incident

Preface (1/2)

At the end of this module, you have reached the following goals:

• You know the three pillars of the CIA triad
• You know the need of CIA
• You know how CIA is used in the creation of information security
• You know how CIA is used in the measurement of the impact of a security incident
• You know the CIANA model, which is an extension the CIA model

Preface (2/2)

The model we are going to deal with is the “CIA triad”. It has two main purposes

• Does my work have the right impact?
• What is the impact of the security incident?

Purpose of CIA

The CIA triad can be used to provide a baseline standard for evaluating and implementing information security.Does the outcome of my IT solutions fit in the security recommendations of the CIA framework?

Does my work have the right impact?

The CIA triad can be used to evaluate the effect of a cyber incident on information security. When a security incident has occurred, we want to measure the impact of the incident on the organisation's information security

What is the impact of the security incident?

CIA, in the context of information security, stands for Confidentiality, Integrity, and Availability

What is CIA?

What is CIA - Confidentiality (1/2)

On a personal-use level

• VPN
• anti tracker extensions
• encryption of end systems

On an enterprise level

• data classification
• access control
• data encryption

What is CIA - Confidentiality (2/2)

What is CIA - integrity (1/2)

On a personal-use level

• limit access to data
• change permissions
• install antimalware software

On an enterprise level

• use hash values
• use data validation checks
• use data consistency checks
• make backups
• logfiles
• use error detection software

What is CIA - integrity (2/2)

What is CIA - Availability (1/2)

On a personal-use level

• e mail is reachable on different devices
• when wifi is not available, you can use mobile data

On an enterprise level

• system redundancy
• system backups
• increased system resiliency
• Equipment maintenance
• Up-to-date operating systems and software
• Plans in place to recover quickly from unforeseen disasters
• Use DDOS mitigations

What is CIA - Availability (2/2)

The CIA triad enables organizations and security professionals to establish reliable and secure systems by considering each aspect of the triad. We’re going to apply this to an example, CIA in ATM solutions.

Example of CIA and information security (1/6)

Confidentiality in ATM solutions

• Is built in a way that only the person in front of the ATM can see the screen clear, to prevent shoulder surfing
• You need a combination of a bank card and PIN code to get money (2FA)
• …

Example of CIA and information security (2/6)

Integrity in ATM solutions = ACCOUNTING

• transfers are reflected in the user’s bank account
• withdrawals are reflected in the user’s bank account
• …

Example of CIA and information security (3/6)

Availability in ATM solutions

• in a public place
• is also accessible when the bank is closed
• you have more than 1 ATM in the city
• …

Example of CIA and information security (4/6)

Does the implementation of CIA mean that the ATM cannot be attacked? NO Example of a possible attacks: A thermal camera that capture PINs, by identifying which number keys are slightly warmed Solution: Integrate CIA on a higher level like using biometrics, fingerprints,...

Example of CIA and information security (5/6)

In incident response, the CIA triad can be used to measure the impact of the incident.Let’s take a look at the following case: Imagine that an attacker, somehow, manages to gain access to a local Linux system on your network. Let's say the account the attacker is using doesn't have a lot of privileges, but he/she/it can navigate through some directories and view some non-important files. Making changes is not possible with the account.

Example of CIA in a Cyber Incident (1/5)

Impact on confidentialityThe attacker gets a brief overview of the file structure attacker can take a look at some files. Level of impact It remains limited because the information that the attacker finds out is not that critical.

Example of CIA in a Cyber Incident (2/5)

Impact on integrityThe attacker cannot change filesThe attacker cannot delete filesLevel of impactNo impact on integrity

Example of CIA in a Cyber Incident (3/5)

IImpact on availabilityLinux host is still accessibleLevel of impact:No impact on availability

Example of CIA in a Cyber Incident (4/5)

THINK ABOUT OTHER EXAMPLES WITH OTHER IMPACTDISCUSS

Example of CIA in a Cyber Incident (5/5)

As attacks are more and more complex, and security continues to improve, it has been clear that these three principles are insufficient to guarantee the system of complete information security.

The need for CIANA?

CIANA is a security model to cover the shortcomings of the CIA triad. As security continues to improve, it has been clear that Non-Repudiation and Authenticity are also essential parts of a secure system.

What is CIANA?

CIANA - Non-repudiation (1/2)

On a personal level

• When you surf using https, you’re ensured that the origin is trusted and that the data sent is accurate
• …

On an enterprise level

• Logfiles
• Digital signing
• Auditing
• …

CIANA - Non-repudiation (2/2)

CIANA - Authenticity (1/2)

On a personal level

• Using MFA
• Use of face recognition
• …

On an enterprise level

• Biometric data
• MFA
• Smart cards
• …

CIANA - Authenticity (2/2)

CIA, and with extension CIANA, is a good model that can be used daily in IT solutions. - When building an IT solution,- If a security incident does occur

conclusion