Confidentiality (CIA Triad)

Confidentiality in the CIA triad is the ability to keep information in the hands of only authorized users. We achieve this through mechanisms such as access controls and encryption.

One way we could achieve confidentiality is to require logging in with credentials to prove your identity before you can access the requested data. We then put access controls in place. Ideally, in an implicit allow form of access control list. An implicit allow setup means everything gets denied unless you specifically allow access.

Encryption plays a role in confidentiality by protecting data at rest and in transit. Protecting data in transit is critical because preventing eavesdropping can be very difficult.

Multiple users with various degrees of access will likely be on the network, any of which could sniff the network for packets currently being transmitted. If data is sent unencrypted, anyone can see what’s there.

That is a clear violation of confidentiality. However, with encryption, be it end-to-end or Public Key Cryptography, only authorized individuals, can decrypt. When properly implemented, the data obtained would be useless when a threat actor manages to break the encryption.

Leave a Reply

Your email address will not be published. Required fields are marked *

Proudly powered by WordPress | Theme: Journey Blog by Crimson Themes.