4.1Security Fundamentals (CIA and Risk Management)

When considering information security measures, the baseline to return to first is the CIA triad (confidentiality, integrity, availability). Mapping what a given measure protects onto CIA helps avoid both over-investment and gaps in coverage. The element that is compromised differs by situation even for similar incidents: a leak of a customer list is a confidentiality breach, a defaced website is an integrity breach, and a service outage from a DoS attack is an availability breach. Identifying which element is affected is the starting point for choosing a countermeasure.

4.1.1CIA and complementary properties

• Confidentiality means only authorized parties can access information, protected via access control, encryption, and the principle of least privilege. Integrity means information is accurate and up to date, free of unauthorized tampering or destruction, protected via hash verification, separation of access rights, and preserving change history. Availability means authorized parties can use information/systems whenever needed, protected via redundancy, backups, and load balancing.
• Complementary properties: authenticity assures that a party or object genuinely is what it claims to be (digital signatures, certificates). Accountability means who did what and when can be traced afterward (via logs and audit trails). Non-repudiation preserves evidence so an action cannot later be denied by the person who performed it. Reliability means intended behavior continues to be performed consistently.
• Information assets are what must be protected (customer data, source code, servers, know-how—tangible or intangible). A threat is a potential cause of harm to an asset (human, technical, physical, or environmental). A vulnerability is a weakness a threat can exploit (misconfiguration, unpatched software, inadequate training, etc.). A risk materializes only when a threat meets a vulnerability—this relationship is central.

4.1.2The risk management process

• Risk identification is the first step: enumerating an organization's information assets and the threats/vulnerabilities associated with them. Risk analysis estimates the magnitude of each identified risk by assessing its likelihood and impact, using qualitative methods (a high/medium/low matrix) or quantitative methods (monetary estimates).
• Risk evaluation compares the analysis results against the organization's risk criteria (the level of risk it is willing to accept) to decide whether a response is needed and its priority. Risk response is the stage of actually selecting and implementing countermeasures based on the evaluation. These four steps form a continuous activity, revisited repeatedly like a PDCA cycle.
• The four categories of risk response: risk mitigation (taking measures to reduce likelihood or impact, e.g. deploying a firewall); risk retention (deliberately accepting the risk, e.g. because the cost of mitigation exceeds the potential loss); risk avoidance (discontinuing the activity that causes the risk, e.g. ending the service in question); risk transfer (sharing the impact with a third party via insurance or outsourcing).

Consider a company introducing a new customer management system and trace the risk management flow. In risk identification, you enumerate information assets—"the database holding customer personal data," "the internal web app reachable from outside"—and the threats against each (unauthorized access, insider misuse, DoS attacks). In risk analysis, "unauthorized access to the database" is rated as high likelihood if it is directly exposed to the internet, with severe impact given the scale of personal data involved, whereas "intrusion into a legacy system reachable only from the internal network" is rated as low likelihood. In risk evaluation, you compare these against the organization's risk criteria (e.g. "any risk of leaking 100,000+ personal records must be addressed") and judge the former mandatory to address while the latter might fall within an acceptable range. Finally, in risk response, you might choose deploying a firewall and multi-factor authentication (mitigation) for the former, while for a low-impact area where the cost of countermeasures is not justified you accept it with monitoring only (retention), for a costly, dangerous legacy feature you discontinue it entirely (avoidance), and for catastrophic-but-rare scenarios you take out cyber insurance to share potential damages with an insurer (transfer)—combining different response strategies risk by risk is the realistic picture.

4.1.3Section summary

• CIA = confidentiality, integrity, availability. Complementary properties include authenticity, accountability, non-repudiation, and reliability
• Risk materializes from threat x vulnerability. Managed continuously via identification -> analysis -> evaluation -> response
• Four risk-response categories: mitigation, retention, avoidance, transfer. Chosen case by case based on cost-effectiveness