8.4 Interrelationship of Components Required for Effective Security

The CIA triad is a security model used to guide the protection of systems and data.

Confidentiality:

• Ensures data is kept private
• Achieved by controlling who can access data

Integrity:

• Ensures data has not been altered or tampered with
• Maintained by protecting confidentiality and using controls such as hashing and permissions

Availability:

• Ensures data is accessible and usable when required
• Supported by ensuring integrity and preventing disruption

These three principles are interrelated: improving one often supports the others.

Identification involves recognising an individual within a digital system.

Methods include:

• Knowledge‑based methods (e.g. usernames)
• Possession‑based methods (e.g. access cards, tokens)
• Biometric‑based identification (e.g. fingerprints)

Drawbacks: identifiers can be guessed or stolen.

Authentication verifies the identity claimed during identification.

Techniques include:

• Passwords and passphrases
• Multi‑factor authentication (MFA)
• Biometric authentication

Benefits: increased security.
Drawbacks: usability issues and management overhead.

Authorisation determines what authenticated users are permitted to do.

This is achieved through:

• Role‑based access control
• Access control lists (ACLs)

Benefits: limits damage from compromised accounts.
Drawbacks: poor configuration can restrict productivity.

Accountability ensures actions in a system can be traced to a user.

Techniques include:

• Audit logs
• User activity monitoring

Benefits: supports investigations and compliance.
Drawbacks: storage, privacy, and monitoring overhead.