Cyberstudy
PDF p.13 Completed

Information Security

Open PDF at p.13 9 flashcards

Summary

PDF p.13

Information security (infosec) involves protecting data resources from unauthorized access, attack, theft, or damage. It ensures data confidentiality, integrity, and availability, collectively known as the CIA Triad. Non-repudiation is also a critical aspect, ensuring actions cannot be denied.

In plain words

Supplementary — not from your PDF

Information security keeps data safe in three ways: only the right people can see it (confidentiality), nobody can secretly change it (integrity), and it's there when people need it (availability). Non-repudiation adds proof of who did what, so nobody can later deny an action.

Detailed explanation

PDF p.13
  • CIA Triad
    • Confidentiality
      • Definition: Information can only be read by authorized individuals.
      • Purpose: Prevents unauthorized access to sensitive data.
    • Integrity
      • Definition: Data is stored and transferred as intended, without unauthorized modifications.
      • Purpose: Ensures data accuracy and trustworthiness.
    • Availability
      • Definition: Information is accessible to authorized users when needed.
      • Purpose: Ensures reliable access to data and resources.
  • Non-repudiation
    • Definition: Ensures that a person cannot deny performing an action, such as creating, modifying, or sending a resource.
    • Example: Legal documents, like wills, often require witnesses to confirm their execution.

Important terms

taken from the text above
Confidentiality
Information can only be read by authorized individuals.
Integrity
Data is stored and transferred as intended, without unauthorized modifications.
Availability
Information is accessible to authorized users when needed.
Non-repudiation
Ensures that a person cannot deny performing an action, such as creating, modifying, or sending a resource.

Examples & real-world scenarios

Supplementary — not from your PDF
  • Confidentiality: encrypting a laptop's disk so a thief can't read the files.
  • Integrity: publishing a file's hash so people who download it can check it wasn't altered.
  • Availability: a backup power supply that keeps a web server online during a power cut.
  • Non-repudiation: a digitally signed email proves the sender really sent it.

Scenario

Ransomware hits a hospital's patient-records system. Doctors can't open charts (availability), the attackers threaten to leak the records (confidentiality), and staff can't be sure restored files weren't tampered with (integrity). One incident can hurt all three properties, so read carefully which one a question asks about.

Common mistakes

Supplementary — not from your PDF
  • Confusing integrity with confidentiality. Integrity means the data is unaltered, not that it is secret.
  • Listing non-repudiation as part of the CIA triad. It is an extra goal that sits alongside the triad.
  • Assuming encryption solves everything. It protects confidentiality, but it doesn't keep a service available.

Practical skills

Supplementary — not from your PDF
  • Classify an incident by which CIA property (or non-repudiation) it affected.
  • Pick a control that protects a specific property, such as hashing for integrity or redundancy for availability.

What I should remember

Key Points PDF p.13
  • CIA Triad
    • Confidentiality: Authorized access only.
    • Integrity: Accurate and unaltered data.
    • Availability: Reliable access for authorized users.
  • Non-repudiation
    • Definition: Actions cannot be denied.
    • Example: Witnesses for legal documents.