1.1.1. Key Security Principles

• Confidentiality: Ensuring that sensitive data is accessible only to authorized users.

Confidentiality is about keeping sensitive information private. This means that only those who have been granted access, such as authorized users, can view or use the data. Organizations implement various measures, such as data encryption and access controls, to protect sensitive information from unauthorized people.

Think of confidentiality like a locked filing cabinet in an office. Only certain employees have the keys to access confidential documents inside. If someone without a key tries to access the filing cabinet, they won’t be able to open it, ensuring that the sensitive information remains safe.

• Integrity: Protecting data from being altered by unauthorized users or during transit.

Integrity refers to the accuracy and reliability of data. It ensures that information remains unchanged and uncorrupted throughout its lifecycle, both when it is being stored and when it is being transmitted. Techniques such as checksums, hashes, and secure connections are employed to maintain data integrity.

Imagine sending a sealed envelope through the mail. To ensure that the letter inside hasn’t been tampered with, you might use a wax seal. If the seal is broken when the recipient receives the envelope, they know the contents may not be trustworthy. Similarly, integrity checks help ensure data hasn't been altered.

• Availability: Ensuring that systems and data are available to users when needed.

Availability guarantees that authorized users have timely and uninterrupted access to information and resources. This involves protecting against disruptions from various threats, such as cyber-attacks or hardware failures. Redundancies, backups, and network security measures are common strategies to enhance availability.

Think of availability like a grocery store that is always open for its customers. If the store sometimes closes unexpectedly due to power outages or other issues, customers can't get their groceries, which affects the store’s reliability. In the digital world, we want to ensure our systems are running continuously, so users can access data at any time.

• Authentication: Verifying that a user or system is who it claims to be.

Authentication involves confirming the identity of users or systems. This is typically done through various methods, such as passwords, biometric data, or security tokens. Proper authentication is crucial in determining whether access to data or resources should be granted.

Consider entering a secure building where you need a badge to get in. Before you’re allowed inside, security checks your badge to confirm your identity. Similarly, in digital systems, users must provide valid credentials to prove their identity before accessing restricted resources.

• Authorization: Granting permission to authenticated users to access specific resources.

Authorization determines what an authenticated user is allowed to do or access. After a user has been verified, the system checks their permissions to see if they have the right to perform certain actions on resources, like viewing files or executing commands.

Imagine a VIP concert where having a ticket gives you access to certain areas. Just because you have a ticket to get inside doesn’t mean you can go backstage; you need the right wristband for that. In a similar way, in web applications, authorization establishes what users can or cannot do based on their permissions.

• Non-repudiation: Ensuring that a user cannot deny having performed a specific action.

Non-repudiation refers to the ability to ensure that an individual cannot deny the authenticity of their signature on a document or the sending of a message. Techniques such as digital signatures and audit logs are deployed to establish clear proof of actions taken by users.

Think of non-repudiation like a signed contract. Once you sign a contract, you can't later claim you didn't agree to the terms because your signature is proof of your consent. In digital transactions, mechanisms like digital signatures provide a similar assurance, preventing users from denying their actions.

--