Confidentiality, Integrity, Availability.
These three terms represent the core principals of any effective information security program. Although often used interchangeably due to their tightly integrated concepts and areas of focus, the facets of a program for which they are used effectively differ in the implementation of controls. Information security practices are ever evolving based on the dynamic threat landscape. As such, your IT staff is bombarded from many directions and must remain agile and informed to apply effective response to meet these challenges. This pressure includes internal policy, regulatory requirement, and don’t forget about the external hackers looking to do you harm.
Confidentiality
Keeping your data, or your client’s data, confidential means preventing it from being accessed by or exposed to unauthorized individuals. There are many ways data can be kept from prying eyes or innocent bystanders. Access controls, password protection, and encryption are just three ways to help protect the data. Many states have passed strict privacy laws requiring data confidentiality. Technologies such as full disk encryption for laptops and encrypting backups going off site are seen as mandatory in every business that has this data. Your staff may not have confidential data on those laptops, but in addition to loosing the passwords cached on those laptops, the brand damage due to the perception of the loss itself may be worse.
Integrity
Data integrity applies to any piece of data that is considered an authoritative source and/or is used for decision-making purposes. When data has integrity, there is assurance that unauthorized, malicious or accidental modifications have not been made to it. For example, an employee relies on a spreadsheet of receivables, if the spreadsheet has integrity, that employee can feel comfortable the data has not been modified by anyone outside of those job responsibilities. Emails sent with digital signatures mean the one just received from the CEO/President of the company telling everyone they can have Friday off is legitimate.
Availability
Finally, data availability is ensuring the right people have access to the right data when they need it. Following the same spreadsheet example as above, this means that the spreadsheet file is available when needed. If the current copy of the file becomes corrupt or accidentally deleted, availability controls ensure that a backup copy can be quickly accessed or restored. Important data should always have redundancy, as hardware will eventually fail. Redundancy, and the level of redundancy you build in depend on the importance of the data and the cost benefit, (money spent vs value) to protect the data. Highly available, geographically dispersed, or clustered architectures, may be too little, or too much, to spend on data availability depending on your business.
Examples of common IT Security Controls
| IT Control | Confidentiality | Integrity | Availability |
| Access Controls |
o |
||
| Passwords |
o |
o | |
| Encryption |
o |
o | |
| Digital Signature | o | ||
| Backups | o |
o |
|
| Clustered Servers |
o |
||
| Redundant data centers |
o |
Information security is a never-ending cycle, but a false sense of security can be devastating to an organization. You need to have assurance that the controls that you have in place will protect your most valuable assets; and keep you from reputational, regulatory or financial harm. Often management assumes a vendor’s product implementation is secure, all systems are fully patched, or anti-virus is working 100%, but never put it to the test. Vulnerabilities are constantly discovered and exploits are often not far behind. You, your IT staff, or your outsourced IT provider must be vigilant and test your controls often.
IT Controls are an integral part of an effective information security program.
Build a culture of “trust but verify”; no harm has ever come from efforts validating your controls. Depending on your business, it may even be required to have an independent party review those controls on a regular basis.
For more on IT Controls, contact us today! 844-OCD-TECH
