3

I sometimes get confused between confidentiality and availability. This site defines confidentiality as

Measures undertaken to ensure confidentiality are designed to prevent sensitive information from reaching the wrong people, while making sure that the right people can in fact get it

and availability as

Availability of information refers to ensuring that authorized parties are able to access the information when needed.

What's the difference? Is confidentiality more about restricting and availability is more about permitting?

4

Confidentiality is concerned with ensuring unauthorised users cannot access a protected resource.

Availability is concerned with ensuring authorised can access a protected resource.

It is important that a resource is available, because otherwise an attacker might cause damage simply by preventing authorised users from accessing a resource, even without the attacker being able to access the resource themselves.

A physical metaphor for availability might be an attacker going to all the fire escapes on a building and bolting them shut from the outside. The attacker doesn't need to compromise the existing locks to do this (and therefore they can't get inside the building themselves), but if there's a fire the attacker can still cause significant harm.

  • Would availability be concerned with how purposefully guessing a users password incorrectly several times can lock him out of his account? – Celeritas Oct 18 '15 at 1:43
  • 1
    Yes, in that case an attacker has prevented an authorised user from accessing a protected resource (ie. their account). – thexacre Oct 18 '15 at 1:54
3

Is confidentiality more about restricting and availability is more about permitting?

No, both permitting and restricting are about confidentiality.

  1. Confidentiality: a set of rules that limits access to a certain data. The permissions/privileges set for users are definitely a confidentiality measure as they define levels of restrictions of access to some information/resources.

  2. Availability: suppose a company's website becomes a victim of successful DoS attack, the resources of that website are no longer available to its customers. Availability is thus about information being available when it is needed but only to people who are supposed to have right to access to it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.