1.1Objectives of information security: the CIA triad and related properties

The first skill expected of a Registered Information Security Specialist is the ability to precisely articulate "what is being protected." When a security officer receives an incident report, the first step is to identify which security property has been compromised. Information leakage implicates confidentiality, data tampering implicates integrity, and service outage implicates availability—misclassifying the property leads to misprioritizing the response. This section covers the CIA triad and related management properties as a judgment framework for incident response.

1.1.1The CIA triad (confidentiality, integrity, availability)

• Confidentiality means only authorized parties can access information. The typical breach is information leakage or eavesdropping via unauthorized access, and the core countermeasures are access control, encryption, and least privilege.
• Integrity means information is accurate and has not been altered or destroyed without authorization. The typical breach is unauthorized data modification or fraudulent transactions via impersonation, and the core countermeasures are digital signatures, hash-based tamper detection, and access-control logging.
• Availability means authorized parties can reliably access information and systems whenever needed. The typical breach is service outage from a DoS/DDoS attack or encryption by ransomware, and the core countermeasures are redundant configuration, bandwidth/traffic control, and backup and recovery planning (BCP).

1.1.2Extended management properties (authenticity, accountability, non-repudiation, reliability)

• Authenticity ensures that a user, piece of information, or system genuinely is what it claims to be. User authentication, digital signatures, and sender domain authentication (SPF/DKIM/DMARC) as countermeasures against impersonation fall under this property.
• Accountability is the ability to uniquely trace after the fact who performed a given action. Recording and preserving access logs and audit trails is the core countermeasure, and it directly deters insider misconduct.
• Non-repudiation preserves evidence so that a party cannot later deny having performed an action (sending, approving, etc.). Digital signatures and timestamps prove, in a way that cannot later be refuted, who performed the action and what it was.
• Reliability is the property of a system continuing to behave as intended, consistently. It is closely related to availability in that both guard against malfunction from design or implementation flaws, but reliability focuses on "continuing to work correctly" rather than merely "being up."

1.1.3OECD Security Guidelines

• The OECD Security Guidelines set out international basic principles for the security of information systems and networks (awareness, responsibility, response, ethics, democracy, risk assessment, security design and implementation, security management, reassessment, etc.), forming the basis for information-security-related legislation and organizational security policy in many countries.

Suppose a CSIRT member at an EC site receives three incident reports at once: (1) an attacker appears to have used SQL injection to view a database containing customers' names and card information; (2) order-quantity data in the order-management system was altered by someone who bypassed the proper approval workflow; (3) a flood of requests overwhelmed the web server, making it unresponsive and taking the service down. The CSIRT member first classifies which property was compromised. (1) is a breach of confidentiality, since information was viewed by an unauthorized party, and the top priority is reviewing access control for the affected data and determining the scope of impact (investigating whether leakage occurred). (2) is a breach of integrity, since data was altered outside the proper process, and the top priority is verifying the before/after diff and identifying who made the change via access logs (leveraging accountability). (3) is a breach of availability, since the service became unusable, and the top priority is restoring service via bandwidth control or load balancing, while investigating in parallel whether a DDoS attack was the cause. If limited staff must handle all three at once, a reasonable priority order—given how fast the real-world harm is spreading and how broad the impact is—is to first contain (1), the confidentiality breach, since customer data may still be leaking (emergency shutdown of the affected function, patching), then restore availability for (3), and finally investigate the root cause of the integrity breach in (2). Classifying by CIA is thus not merely a taxonomy of "what happened" but the basis for prioritizing the response.

1.1.4Section summary

• CIA = confidentiality (cannot be seen), integrity (cannot be altered), availability (does not go down). Classify any incident by these three properties first
• Distinguish authenticity (confirming identity), accountability (tracing who did it), and non-repudiation (evidence that cannot later be denied)
• The OECD Security Guidelines are the international basic principles underlying national legislation and organizational policy