Basic Security Principles

Security can be achieved in many ways, but it's pretty well universally agreed that confidentiality, integrity, and availability (CIA) form the basic building blocks of any good security initiative. Although the acronym of CIA, used for the security triad, may not be as intriguing as the governmental agency with the same name, it most likely fits the priorities of security professionals better.

The concept of availability provides that information and systems are available when needed. Although many may think of availability only in electronic terms, it also applies to physical access. If you need access at 2 a.m. to backup tapes that are stored in a facility that allows access only from 8 a.m. to 5 p.m., you definitely have an availability problem.

Availability in the world of electronics can also manifest itself in many ways. Having access to a backup facility 24/7 does little good if there are no updated backups to restore from or if backups haven't been tested to ensure that they work. Backups are the simplest way to ensure availability. Backups provide a copy of critical information should files and data be destroyed or equipment fail. Failover equipment is another way to ensure availability. Systems such as redundant array of inexpensive disks (RAID) and redundant sites (hot, cold, and warm) are two examples. Disaster recovery is tied closely to availability because it's all about getting critical systems up and running quickly. Availability is attacked by denial-of-service (DoS) attacks.

Russian Mob Targets Companies for DoS

Criminal gangs from the former Soviet Union have been quite active in targeting random companies for extortion. The victim is typically contacted and asked for protection money to prevent the victim from being targeted for DoS. Those that don't pay are targeted for attack. One such site, multibet.com, refused to pay and was brought under DoS attack for more than 20 days. After the company paid the extortion, the DoS attack was lifted. Companies targeted for attack have two possible choices: pay up and hope they're not targeted again or install protective measures to negate the damage the DoS may have done.

Integrity is the second piece of the security triad. Integrity provides for the correctness of information and allows users of information to have confidence in its correctness. Integrity can apply to paper documents as well as electronic ones. We have all seen some of the checks and balances used to protect the integrity of paper documents. It is much easier to verify the integrity of a paper document than an electronic one. For a good example, look no further than the 2004 election. Some sources claimed to have documents that placed the president's military service in an unfavorable light. Typography experts quickly raised questions about the integrity of the memos, stating that they appeared to be computer generated in a way that wasn't even available in the early 1970s. Certainly, forgers can copy and create fake paper documents, but it is not a skill easily learned. Protecting and verifying the integrity of electronic documents and data is much more difficult. Integrity must be protected in two modes: storage and transit.

Information in storage can be protected by using access and audit controls. Cryptography can also protect information in storage through the use of hashing algorithms. Real-life examples of this technology can be seen in programs such as Tripwire, MD5Sum, and Windows File Protection (WFP). Integrity in transit can be ensured primarily by the protocols used to transport the data. These security controls include checksums, hashing, and cryptography.

Confidentiality addresses the secrecy and privacy of information. Even today, we can see a number of controls used in the real world to protect the confidentiality of information. Items such as locked doors, armed guards, and fences are but three such examples. Others include information-classification systems, such as the commercial and military data classification systems. Just as with integrity, confidentiality must be protected in storage and in transit. For an example, let's return our attention to backups. News reports have detailed several large-scale breaches in confidentiality, such as corporations misplacing or losing backup tapes with customer account, name, and credit information. The simple act of encrypting the backup tapes could have prevented or mitigated the damage.

Cryptography is also a useful tool to protect the confidentiality of information in transit. By sending information in an encrypted form, attackers are denied the opportunity to sniff clear-text information. Just because they cannot understand the information does not mean that it doesn't have any value to the attacker. Some military agencies set up channels that transmit a constant flow of traffic, thereby preventing attackers from performing inference attacks. Inference occurs anytime an attack may notice a spike in activity and infer there is some pending event. It may be hard to believe, but some news agencies actually monitor the White House for pizza deliveries. The belief is that a spike in pizza deliveries indicates that officials are working overtime and that there is a pending event of importance.

Note

The new standard for cryptographic protection became Advanced Encryption Standard (AES), also known as Rijndael, in November 2001. This came after the U.S. government spent five years studying what would replace the aging Data Encryption Standard (DES). Rijndael can be implemented in one of three key sizes: 128, 192, and 256 bits. It is considered a fast, simple, and robust symmetric encryption mechanism.