Classify incidents with the CIA triad

Environment

Pen and paper or a spreadsheet. No computer setup needed.

Before you start

• Read Information Security (p.13) and Security Control Functional Types (p.19).

You will

• Label incidents by the CIA property they affect
• Pick a preventive, detective and corrective control for each

Steps

1. 1

   Make a table with columns: Incident · Confidentiality · Integrity · Availability · Non-repudiation · Control that would help.

2. 2

   Add these incidents: a stolen unencrypted laptop; a website taken offline by a traffic flood; an attacker changing prices in an online shop; an employee denying they approved a payment; ransomware encrypting a file server.

3. 3

   Tick every property each incident affects. Some affect more than one, such as ransomware (availability, and often confidentiality if data is also stolen).

4. 4

   For each incident, write one preventive control (e.g. full-disk encryption), one detective control (e.g. log monitoring) and one corrective control (e.g. restore from backup).

5. 5

   Compare your answers with the definitions on p.13 and p.19 of your guide and correct any mismatches.

Check your understanding

• ?Why is the price change an integrity problem even though no data was stolen?
• ?Which control gives non-repudiation for the payment approval?
• ?Which of your controls are technical, and which are operational or managerial?