CISSP: Confidentiality, Integrity and Availability

Confidentiality

Prevent or minimize unauthorized access to data while in storage, in process, and in transit.

Attacks focused on violation of confidentiality

• Capturing network traffic, 
• Stealing password files, 
• Social engineering techniques, 
• Port scanning, 
• Eavesdropping, 
• Sniffing, 
• Escalation of privileges etc.

Events that lead to confidentiality breaches

• Failing to properly encrypt a transmission, 
• Failing to fully authenticate a remote system before transferring data, 
• Leaving open otherwise secured access points, 
• Accessing malicious code that opens a backdoor, 
• Misrouted faxes, 
• Documents left on printers, 
• Walking away from an access terminal while data is displayed on monitor etc

Countermeasures

• Encryption for data at rest (whole disk, database encryption), 
• Encryption for data in motion (IPSec, TLS, PPTP, SSH) 
• Network traffic padding (technical), 
• Strict access control (physical and technical), 
• Rigorous authentication procedures (technical), 
• Data classification (administrative and technical), and 
• Extensive personnel training (administrative)

Other aspects of confidentiality includes

• Sensitivity refers to the quality of information, which could cause harm or damage if disclosed.
• Discretion an act of decision where an operator can influence disclosure to minimize damage.
• Criticality the level to which information is mission critical.
• Concealment an act of hiding or preventing disclosure. (Security through obscurity)
• Secrecy  an act of keeping something a secret or preventing the disclosure of information.
• Privacy act of keeping personally identifiable information confidential that might cause harm, embarrassment, or disgrace to someone if revealed.

• Seclusion involves storing something in an out-of-the-way location.
• Isolation an act of keeping something separated from others. Prevent commingling of information 

Integrity

Protect the reliability and correctness of data. Integrity protection prevents unauthorized alterations of data and ensures that data remains correct, unaltered, and preserved.

Integrity can be examined as:

• Prevent unauthorized subjects from making modifications 
• Prevent authorized subjects from making unauthorized modifications
• Maintain internal and external consistency of objects so that their data is a correct and true 
reflection of the real world

Attacks focused on violation of integrity

• Viruses, logic bombs, 
• Unauthorized access, 
• Errors in coding and applications, 
• Malicious modification, Intentional replacement, and 
• System backdoor

Countermeasures

• Strict access control (physical and technical), 
• Rigorous authentication procedure (technical),
• Configuration management (system integrity),
• Change control (process integrity),
• Software digital signing, 
• Intrusion detection systems (technical), 
• Object/data encryption (technical), 
• Hash total verifications (data integrity), 
• Interface restrictions, Input/function checks (technical), and 
• Extensive personnel training (administrative)

Other aspects of integrity includes

• Accuracy: Being correct and precise
• Truthfulness: Being a true reflection of reality
• Authenticity: Being authentic or genuine
• Validity: Being factually or logically sound
• Nonrepudiation: Not being able to deny having performed an action
• Accountability: Being responsible or obligated for actions and results
• Responsibility: Being in charge or having control over something or someone
• Completeness: Having all needed and necessary components or parts
• Comprehensiveness: Being complete in scope; the full inclusion of all needed elements

Availability

Authorized subjects are granted timely and uninterrupted access to objects; offers a high level of assurance that the data, objects, and resources are accessible to authorized subjects.

Threats to availability

• Device failure, 
• Software errors, and 
• Environmental issues (heat, static, flooding, power loss etc)

Attacks focused on violation of availability

• DoS attacks, 
• Object destruction, and 
• Communication interruptions

Events that lead to availability breaches

• Accidentally deleting files, 
• Over-utilizing a hardware or software component, 
• Under-allocating resources, and 
• Mislabeling or incorrectly classifying objects.

Countermeasures

• Design intermediary delivery systems properly,
• Use access controls effectively,
• Monitor performance and network traffic,
• Use firewalls and routers to prevent DoS attacks,
• Implement redundancy for critical systems (RAID, clustering, load balancing, disk shadowing, failover clustering), and
• Maintain and test backup systems

Other aspects of integrity includes

• Usability: state of being easy to use or able to be understood and controlled by a subject.
• Accessibility: assurance that widest range of subjects can interact with a resource regardless of their capabilities or limitations.
• Timeliness: Being prompt, on time, within a reasonable time frame, or providing low-latency response.

Availability depends on both integrity and confidentiality. Without integrity and confidentiality, availability cannot be maintained.

CIA Priority

• Military/government organizations, IT systems: tend to follow CIA Triad
• Private companies, Operational technology: tend to follow AIC

However, focuses on one aspect of security over another does not mean that other items are ignored or improperly addressed.

Reference

Mike Chapple. (ISC)2 CISSP Certified Information Systems Security Professional Official Study Guide. 
Shon Harris. CISSP All-in-One Exam Guide.

Threat to Data

Threats to Data is when threat agent can cause violation of CIA. Some examples of compromise

• Confidentiality

- User account or system compromise
- Loss or theft of laptop, removable media, printed content
- Eavesdropping, shoulder surfing, sniffer, dumpster diving

• Integrity

- Errors and Omission. People making mistake, simple mistake, not willful nor malicious in nature. I meant to type 10 while it so happened is 100.
- Insider Threat: Your accountant cooks the book by writing himself cheque of $10,000 while he was supposed to write for $1000.
- Man in the Middle
- Falsified invoices

• Availability

- Hard disk drive crash
- Server failure, Newtork failure
- Corruption
- DoS, DDoS

Confidentiality - Violation and Countermeasure

There are many forms of attacks that leads to the violation of confidentiality. These can be divided into two parts a. Directed attacks and b. Non-directed attacks

Direct Attacks

• Capturing network traffic,
• Stealing password files
• Social engineering, 
• Port scanning, 
• Shoulder surfing, 
• Eavesdropping, 
• Sniffing, 
• Privilege escalation

Non-directed Attacks

• Human error, oversight, or ineptitude
• Failing to properly encrypt a transmission, 
• Failing to fully authenticate a remote system before transferring data, 
• Leaving open otherwise secured access points, 
• Accessing malicious code that opens a back door, 
• Misrouted faxes, 
• Documents left on printers, or 
• Even walking away from an access terminal while data is displayed on the monitor

Countermeasures

• Encryption, 
• Network traffic padding, 
• Access control, 
• Rigorous authentication procedures, 
• Data classification, and 
• Extensive personnel training

Cyber Security: Firewall - VPN

VPN basics
In some ways, our local networks resemble forts sitting in the Wild West of a Hollywood movie. Inside strong walls, life goes on as normal, with data being exchanged freely between trusted machines. Meanwhile, beyond the firewall there is the lawless frontier of the internet; traffic crossing the internet must make a risky journey largely unprotected.

The problem of secure data transmission is especially acute for organisations based in several physical locations, such as those who need to exchange information with sub-contractors or those with a dispersed workforce such as sales teams or home workers.



Traditionally, companies invested in private communications links (usually called leased lines) whose cost might run to thousands of pounds per month. Most organisations cannot justify such an investment and in any case, leased lines cannot serve a mobile or highly dispersed workforce. So the lawless frontier of the internet is our only choice – this is where VPNs come to the rescue!

A VPN, as the name implies, is a means of creating a private network across an untrusted network such as the internet. VPNs can be used for a number of different purposes such as:

• to securely connect isolated Local Area Networks (LANs) across the internet
• to allow mobile users remote access to a corporate network using the internet
• to control access within an intranet environment.

VPN concepts
VPNs are typically implemented using dedicated network devices (sometimes this might be a firewall), and software. There are two parts to the software; the first, called a VPN client, is installed on the computer of anyone who wants to be part of the VPN. The client is responsible for connecting users to the VPN so that it can send and receive information in a secure manner with, in this example, a corporate network. The second part is the VPN server which is part of a dedicated network device, usually located on the perimeter of an organisation’s network. The server software typically performs the authentication of users and route traffic to the corporate network.

The VPN software creates a path known as a ‘tunnel’ between the VPN client and the VPN server. It can establish this ‘tunnel’ by using any third party or untrusted network such as the internet. Unlike other paths through the internet, information which passes through this ‘tunnel’ can be encrypted to protect it from inspection or modification. So we can use these tunnels to protect our data while it crosses the lawless frontier of the internet back to the safety of our forts!

Securing the tunnels
The VPN path or tunnel between the VPN client and the VPN server relies on encryption to protect the data from interception or modification as it travels across the internet.



Encryption
In a VPN, encryption and decryption is typically performed by the client and server software. Early VPN solutions used proprietary encryption techniques, but shortcomings in many of these methods has forced a switch to public encryption standards.

Authenticity and integrity
It is vital to ensure that information can be trusted – that it is coming from an authenticated user and that it has not been altered in transit. VPNs use a number of methods to ensure authenticity:

• hashes (see Week 5)
• digital signatures (see Week 5)
• message authentication codes (MACs).

MACs are appended to messages and act as an authenticator. They are similar in principle to digital signatures, but the hash is encrypted and decrypted using the same secret key, (symmetric encryption).

VPN protocols
There are three main forms of VPN protocol currently in use, these are:

• PPTP (Point to Point Tunnelling Protocol)

PPTP was designed in a consortium led by Microsoft, which included an implementation of the protocol as a standard component of Windows NT 4. Microsoft also released PPTP as a free add-on to Windows 95 and Windows 98, allowing users of (at the time) the most popular version of Windows to access corporate networks.



PPTP proved unsuited to large companies (being limited to 255 connections per server), but more seriously, the PPTP standard did not settle on a single form of user authentication or encryption; therefore two companies could offer software supporting PPTP, yet each product would be incompatible with the other! From Windows 2000 onwards, Microsoft replaced PPTP with L2TP (see below).

• L2TP (Layer 2 Tunnelling Protocol)

This is an adaptation of a VPN protocol known as L2F originally developed by Cisco to compete with PPTP. In an attempt to improve L2F, a successor was devised by a group composed of the PPTP Forum, Cisco and the Internet Engineering Task Force (IETF). L2TP combines features of both PPTP and L2F.

• IPSec (Internet Protocol Security)

IPSec was designed by an international committee (The Internet Engineering Task Force (IETF)) between 1992 with a first draft standard published in 1995, the revised standard was published in 1998. IPSec is now the most widely supported protocol with backing from Intel, IBM, HP/Compaq and Microsoft (among others).

                               

IPSec has gained a reputation for security thanks to its use of well-known and trusted technologies. Rather than invent new techniques for encryption, the designers of the protocol built their system on top of existing encryption technologies, which had, in themselves been subjected to intense scrutiny.