5

I'm a newbie in security. I read a lot (recently read this book), and now asking question just to be sure if I understood everything.

Here are my questions (or assumptions), which of them are correct?

  • Confidentiality: to ensure confidentiality, we can use encryption
  • Integrity: to ensure integrity, we can use encryption, or data signing
  • Authentication: to ensure authentication, we can use data signing
  • Availibility: is ensured no matter what we use - we can use encryption, data signing, or we can not use them - we always have the Availibility
  • You use Nagios for Availability or similar. It's part of Information Security according to myself and the CIA. For authentication you need protocol to communicate (confidentiality) and secure password storage (hashing like scrypt / bcrypt). – Aria Nov 8 '16 at 14:10
11

Your question is difficult to answer because security is a property of a system, not a property of a single technology or algorithm.

Confidentiality

It can be assured using encryption, but that's not enough. You need to look at the whole system to give a meaningful answer.

Here's a system that uses encryption and doesn't guarantee confidentiality: The WEP wireless encryption system. It is flawed because is reuses IVs too fast (I think), meaning that you can decrypt WEP communications after listening to the encrypted traffic for a while.

Also, sometimes the content of a message isn't as important as the fact that there was a message at all. So just knowing that A sent a message to B might already be enough to destroy confidentiality. If you call a suicide prevention hotline and I learn of this conversation, I can be fairly sure what you were talking about without knowing the exact content of the conversation.

Integrity and Authentication

You have a related problem when using encryption for integrity. Assume you're using a block cipher which encrypts data in 8 byte blocks. Assume you're trying to protect the integrity of the string "I give Reinards $1000000". You encrypt that, yielding "a7nBg2iUlRaM1iiRT64O21pm". What's to stop me from taking the last 8 bytes of the ciphertext and replacing them with something else? As long as it decrypts correctly, how are you going to know it's not the original? And what if I manage to replace the last 8 bytes with something that decrypts to "$9999999", or "my child"? Okay, maybe the times where we sold children into slavery are over, but you've just given me much more than you bargained for. So you don't need encryption for message integrity, you need message authentication, which is commonly done using message authentication codes.

Availability

Availability means the data is there when you need it. You don't just "have" availability in contexts where data sits in a datacenter at the other end of the planet. A large number of systems must interoperate perfectly to allow you to look at that data when you want it. One of these systems may be Nagios, which alerts people to service disruptions. Another might be a set of high-availability solutions which switch over to another datacenter when the first one currently suffers from a power outage or hurricane damage. This has nothing at all to do with encryption or digital signing.

The currently gravest threat to service availabilty is probably distributed denial of service attacks, which are very difficult to counter. No amount of encryption or digital signing can help here.

  • 1
    This is an excellent answer. I'd add that you normally talk about CIA (Confidentiality, Integrity and Availability). Authentication is a means to those, but not an end in and of itself - you likely need authentication for confidentiality (so that only the right person gets the right stuff), for integrity (so that you know who changed what), for availability (so the right people can get the stuff they should). But it is a means to an end rather than an end. – crovers Nov 8 '16 at 16:27
2

No. Confidentiality, Availability and Integrity are the pillars of the security of an information system. You can use data signing and/or encryption to reach your goals, but security cannot be reduced to that.

Confidentiality: only allowed people should be able to read the information. Sending encrypted data can be one way, but using a physical safe for printed document in also important. In the context in IT, it involves authenticating users and only delivering the granted information.

Integrity: only allowed people should be able to change information, and only in a definite way. Here again authentication is involved, but also archives can be a way to recover from incidents that could have altered os destroyed information.

Availabity: In the context of IT, it involves redundant power supplies, RAID disks and redundant network links. For major platforms, data can be duplicated on different data centers to make sure that even if one is not reachable, you can access data from an online backup center.

TL/DR: data signing and encryption in only a small part of the great security pillars Availability, Integrity and Confidentiality.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.