Understanding the CIA Triad and Its Vulnerabilities

1. Introduction to the CIA Triad

At the core of information security is a model known as the CIA triad. This isn't the intelligence agency; it's a framework that defines the three most critical goals for protecting information and systems.

• Confidentiality: Keeping secrets.
• Integrity: Ensuring information is trustworthy and has not been tampered with.
• Availability: Ensuring systems and data are accessible when needed.

Every security control you encounter, and every attack you will learn, is related to upholding or breaking one or more of these principles.

To start, let's get a comprehensive overview from a leading tech company. This video breaks down each component with excellent visuals and examples.

Now, let's dive into each principle one by one.

2. The Three Pillars

A. Confidentiality: Keeping Data Private

Confidentiality is about restricting access to information. It ensures that data is not disclosed to unauthorized individuals, programs, or processes. When an attacker steals a database of user passwords or a company's secret project files, they have breached confidentiality.

To see how this is achieved in practice, let's return to the video.

As the video explained, confidentiality is typically enforced through:

1. Access Controls: These are the rules and mechanisms that control who can access what.

   • Authentication: Proving your identity, often with a password, a security key, or biometrics. Multi-factor authentication (MFA) is a strong form of this.
   • Authorization: Determining if your proven identity has the permission to access the requested resource. This is often managed through roles (e.g., "admin," "user," "guest"). In Linux, this is the user/group/other permission model you've already studied.

2. Encryption: This involves scrambling data so that it can only be read by someone who has the correct key. This protects data "at rest" (stored on a disk) and "in transit" (moving across a network).

B. Integrity: Keeping Data Accurate

Integrity is the assurance that information is trustworthy and accurate. It means data has not been modified in an unauthorized way, whether by a malicious actor or an accidental error. If an attacker can change the price of an item on an e-commerce site or alter a financial transaction, they have compromised integrity.

Let's see how this is explained in the next part of the video.

Maintaining integrity relies on being able to detect unauthorized changes. The key mechanisms for this are:

• Hashing: A hash function creates a unique, fixed-size string of characters (a "hash") from any piece of data. If even one bit of the data changes, the hash will change completely. You can verify a downloaded file's integrity by comparing its hash to the one provided by the source. sha256sum is a common Linux command for this.
• Digital Signatures: These use cryptography to verify not only that the data hasn't been changed (integrity) but also who it came from (authenticity).
• Version Control: Systems like Git are built around integrity. Every commit has a unique hash, creating a verifiable history of all changes.

An attacker who gains root access and deletes their activity from /var/log/auth.log is directly attacking the integrity of the system's records.

C. Availability: Keeping Systems Accessible

Availability ensures that systems, services, and data are operational and accessible to authorized users when they need them. For a business, a loss of availability can mean lost revenue and reputation. For a hospital, it can be a matter of life and death.

The final segment of the video covers this principle and the most common attack against it.

As the video showed, availability is all about resilience. The primary threats are:

• Denial-of-Service (DoS) / Distributed Denial-of-Service (DDoS) Attacks: The goal is to overwhelm a system with so much traffic or so many requests that it can no longer serve legitimate users.
• Ransomware: By encrypting a system's files, an attacker makes them unavailable until a ransom is paid.
• Hardware/System Failures: This includes everything from a cut network cable to a server power outage.

Defenses focus on redundancy (backup systems), failover (automatic switching to a backup), and robust infrastructure that can handle traffic spikes.

3. Attacks on the Triad: The DAD Perspective

Now that we understand the goals of the CIA triad, let's flip it around and look at it from an attacker's perspective. For every security principle, there is a corresponding type of attack. This is sometimes called the DAD triad: Disclosure, Alteration, and Denial.

• Disclosure is a breach of Confidentiality.
• Alteration is a breach of Integrity.
• Denial is a breach of Availability.

The following article provides a clear breakdown of how specific attacks map to these principles.

To solidify this, here's a summary table connecting these concepts. Notice how some attacks can violate multiple principles.

The Bitsight article, "Examples of CIA Triad Attacks," gives more real-world examples. It mentions the Colonial Pipeline attack as a failure of availability and the SolarWinds breach as a catastrophic failure of integrity, where malicious code was inserted into legitimate software updates. These high-profile events show the massive impact of violating these core principles.

Conclusion

You've now learned about the foundational model of information security: the CIA triad. You can define Confidentiality, Integrity, and Availability and, crucially, you can explain how specific attacks are designed to undermine each of these principles.

This framework is your new lens for viewing security. When you analyze a system, you can ask:

• What data needs to be kept secret? (Confidentiality)
• What data must not be changed? (Integrity)
• What services must remain online? (Availability)

As an aspiring penetration tester, your job will be to find and demonstrate weaknesses in these three areas.

Key Takeaways:

• The CIA triad consists of Confidentiality, Integrity, and Availability, the three core goals of information security.
• Confidentiality is about preventing unauthorized disclosure of information, enforced by access controls and encryption.
• Integrity is about ensuring data is accurate and trustworthy, verified through hashing and digital signatures.
• Availability is about ensuring systems are accessible, defended by redundancy and robust infrastructure.
• Attacks can be categorized by the principles they violate: Disclosure (Confidentiality), Alteration (Integrity), and Denial (Availability).

Next Lesson Preview:
Now that we know what we're trying to attack (Confidentiality, Integrity, or Availability), our next lesson will focus on the specific terminology of how an attack happens. We will define and differentiate between a vulnerability, an exploit, and a payload. This will give us the precise language needed as we move closer to hands-on exploitation.