- [Instructor] Before we cover
all the access control fundamentals,
the processes and mechanisms, it is very important
to go over the pillars of access control
and the concepts of confidentiality,
integrity, and availability.
This is also known as the CIA triad.
This is a model designed to use or to guide policies
for information security within an organization.
The model is also sometimes referred to as the AIC triad,
or availability, integrity, and confidentiality.
And this is to avoid confusion
with the US Central Intelligence Agency.
Now, the elements of the triad
are considered the three most crucial components
of cybersecurity.
Now let's go over them.
First, confidentiality.
Confidentiality is the process used
to ensure that only authorized users
can access resources or systems.
Now, an example of this is that you, and only you,
have access to your bank account information,
and nobody else has that.
And another example is that a system that is designed
for storing source code
is only accessed by the engineering department
and not the sales organization
or perhaps finance, and then vice versa,
a financial system that cannot be accessed
from the rest of the company,
but only authorized users in the finance department.
Now, attacks to access control
that protects the confidentiality of a resource
will typically aim at still sensitive
or confidential information.
Now, the next one is integrity,
and that is the process used
to ensure that only authorized users
can modify the state of a resource or a system.
Now, an example is that only authorized users
are able to modify entries in a database,
or, let's say, in a file.
Now attack to access control
that protect the integrity of a resource
will typically aim at changing information.
In some cases,
this can also be the configuration of a system,
like a network infrastructure device,
or a server or a firewall.
Now finally, availability.
Now, availability is a process
to ensure that a system or a resource is available
to users that are authorized to access it,
in a reasonable amount of time, right?
So attacks that will affect the availability
will typically aim at disabling access to a resource,
or to create what we call a denial-of-service condition.
Now, having said that,
denial-of-service attacks are a simple example
of attacks to the availability of a resource or a system.