1.1Security Fundamentals (CIA, Authenticity, Accountability, Non-Repudiation)

When a security manager evaluates a new internal policy or outsourcing contract, the baseline to return to first is the CIA triad (confidentiality, integrity, availability). Mapping what a given control protects onto CIA helps avoid both excessive controls and coverage gaps. In practice, however, CIA alone cannot explain every problem: issues such as "we cannot prove who did this" or "the person can later claim they never did it" require properties beyond CIA. This section first organizes CIA from SG's management perspective, then covers the complementary properties.

1.1.1The CIA triad and management objectives

• Confidentiality means only authorized parties can access information, protected via access-rights review, encryption, and the principle of least privilege. A manager is responsible for periodically reviewing who should be able to access what. Integrity means information remains accurate and up to date, free of unauthorized tampering, protected via preserving change history, approval workflows, and hash verification.
• Availability means authorized parties can use information/systems whenever needed, protected via redundancy, backups, and a business continuity plan (BCP). From a management perspective, a drop in availability directly translates into a business-continuity risk, so it is not enough to rely on technical measures alone — recovery targets (RTO/RPO) must be agreed with management in advance.

1.1.2Complementary properties (authenticity, accountability, non-repudiation, reliability)

• Authenticity assures that a party or object genuinely is what it claims to be (e.g., a digital signature confirms the sender is genuine). Accountability means who did what and when can be traced afterward, underpinned by logs and audit trails. It also functions as a deterrent against insider misuse—knowing that actions are traceable raises the psychological barrier to committing fraud.
• Non-repudiation preserves evidence so that an action or a message cannot later be denied by the party who performed or sent it (e.g., an e-contract uses a digital signature to prevent the signer from later claiming "I never signed this"). Reliability means a system continues to behave as intended, with few malfunctions or failures. Non-repudiation is easily confused with accountability, but accountability only means an action "can be traced," while non-repudiation goes further—ensuring the traced result cannot be overturned by the person themselves.

Consider an accounting department at a company moving to exchange invoices with business partners as electronic data. First, since the invoice data must not be seen by third parties, it introduces encrypted communication to secure confidentiality. Next, to guarantee the amount was not altered in transit, it builds in tamper detection via hash values, addressing integrity. So far this is explainable within the CIA framework, but the department's next concern is "was this invoice genuinely issued by that partner?" This differs from whether the content is correct (integrity) — it requires authenticity, guaranteeing the issuer genuinely is who they claim to be. So the department adopts digital signatures, accepting only invoices signed with the partner's private key. The audit department then requests "a mechanism to trace afterward who approved what and when" — an accountability requirement, met by storing approval logs in a tamper-resistant form. Finally, to prepare for a partner later claiming "we never issued an invoice for that amount," the department combines digital signatures with transmission logs to achieve non-repudiation, so the partner cannot deny having issued it. The realization that even a single goal like "secure the invoices" requires different controls depending on which property is at stake is the core of SG's management perspective.

1.1.3Section summary

• CIA = confidentiality, integrity, availability. Complementary properties include authenticity, accountability, non-repudiation, and reliability
• Accountability = traceable; non-repudiation = cannot be denied. The two are similar but distinct requirements
• A drop in availability directly translates into a business-continuity risk. CIA elements can trade off against each other