Information Security Triad

Questions and Answers

To restrict access to authorized individuals

A computer power surge corrupts a file

Ensuring information is accessible in a timely manner

A stock trader accessing real-time market data Signup and view all the answers

Intentional loss is caused by malicious intent, while unintentional loss is caused by accidents Signup and view all the answers

To identify a user and verify their identity Signup and view all the answers

ACL is based on individual user identities, while RBAC is based on job roles Signup and view all the answers

To protect data from unauthorized access Signup and view all the answers

Every 60 to 90 days Signup and view all the answers

8 characters Signup and view all the answers

Study Notes

To ensure confident computing, devices must not be compromised, and communications must be secure.
The triad consists of confidentiality, integrity, and availability.

Restricts access to authorized individuals to view or access information.
Example: federal law requires universities to restrict access to private student information.

Assurance that information has not been altered and truly represents the intended content.
Information can lose its integrity intentionally (malicious intent) or unintentionally (e.g., power surge, accidental deletion).

Ensures authorized individuals can access and modify information in an appropriate timeframe.
Appropriate timeframe varies depending on the context (e.g., immediate access for a stock trader, daily report for a salesperson).

Authentication: identifies users through one or more factors (something they know, have, or are).
Multi-factor authentication is a more secure way to authenticate users.
Access Control: determines authorized users for reading, modifying, adding, and deleting information.
Encryption: encodes data for transmission or storage, allowing only authorized individuals to read it.
Password Security: choose complex passwords (8+ characters, 1 upper-case, 1 special, 1 number) and change them regularly (every 60-90 days).
Backups: ensures data recovery in case of loss or corruption.
Firewalls: blocks unauthorized access to a network.
Intrusion Detection Systems: detects and alerts on potential security breaches.
VPN: secures internet connections.
Physical Security: protects physical assets and data from unauthorized access.
Security Policy: outlines guidelines and procedures for information security.

Access Control List (ACL): specifies access rights for individual users or groups.
Role-Based Access Control (RBAC): assigns access rights based on user roles, rather than individual users.