Cybersecurity Certificate Course

University of Belize, Dale Baltazar

Module 02 – The Principles of Confidentiality, Integrity, Availability

November 29th, 2023

Ans: The concept of threat modeling is a process in which potential threats are identified and
categorized. Initially, the network administrator identifies vulnerabilities in the system.
Subsequently, they determine and map potential attacks/vectors, followed by figuring out the
best way to eliminate the risk. Afterward, the threat is prioritized by severity and its impact on
the organization, and a response is formulated and dealt with based on priority.

When evaluating the effectiveness of proactive and reactive approaches, the proactive approach,
also known as the adversarial approach, occurs during the early stages of system development. It
is based on anticipating threats and designing specific countermeasures during the coding and
crafting process. On the other hand, the reactive approach, also known as the defensive approach,
takes place after a product has been created and deployed. This approach forms the core concept
behind ethical hacking and source code review.

2. List the security roles in a typical organization and explain why each is important and
where their roles may intersect.

Ans: The security hierarchy within a typical organization begins with Senior Management, who
holds ultimate accountability for the success or failure of security measures. Following them is
the Security Professional, tasked with executing directives provided by Senior Management.
Next in line is the Data Owner, who is responsible for classifying information and ultimately
owns the data, in contrast to the Security Professional who focuses on functional security
responsibilities.

Fourthly, the Data Custodian takes on the responsibility of implementing the protection measures
defined by the Data Owner. This includes tasks such as backup, data validation, deployment of
security solutions, and managing data storage. The user, with access to the secure system, plays a
crucial role in understanding and upholding the security policy. Finally, the Auditor is
responsible for reviewing and verifying the security policy, producing compliance and
effectiveness reports.

It is imperative that each role demonstrates due care in the execution of its duties. The primary
objective for each role is to safeguard the organization, and any negligence in fulfilling their
responsibilities is strictly avoided and subject to sanctions.

3. Discuss the effectiveness of security control concepts and which concept is best at
reducing infiltration of data packets moving between nodes on a network.

Ans: The effectiveness of the security control concept is primarily managed by the network
administrator. Firstly, there must be identification; subjects need to identify themselves. The user
must then authenticate themselves through the use of a password. After authentication, the
system authorizes access. Subsequently, the user is subjected to auditing; at this point, everything
on the system is logged and monitored to detect any unauthorized activities. Users are
consistently placed under scrutiny and held accountable, providing constant proof of identity to
link their actual real identity to the online one.

The most effective concept for reducing the infiltration of data packets moving between nodes on
a network is encryption. Encryption involves encoding or concealing the contents of data so that
only those with the proper credentials can decrypt it. Encryption should be applied to everything,
including USB thumb drives, portable drives, and hard drives. This represents the most critical
security control.

4. Briefly discuss the principles of Confidentiality, Integrity, and Availability with reference
to how the concepts which underpin Confidentiality may intersect with integrity and
Availability.

Ans: The primary objective for security advocates is to attain the goals of confidentiality,
integrity, and availability while ensuring alignment with organizational objectives. To
commence, the principle of confidentiality mandates that all data be safeguarded, at the very
least, as private and treated with discretion. Essentially, data must be shielded against
unauthorized access, observation, and utilization, necessitating protection at each stage of its
lifecycle—storage, processing, and transit.

The principle of integrity asserts that information and systems should be shielded from
intentional, accidental, or unauthorized changes. Data integrity implies that information known
to be accurate can be trusted as complete, consistent, and accurate. The final principle, heavily
reliant on the other components, is availability. The underlying rationale is that secure systems
must not only adhere to rules promoting confidentiality and integrity but also ensure authorized
access to data at all times.

Confidentiality may intersect with integrity: The convergence between confidentiality and
integrity lies in safeguarding the accuracy and completeness of sensitive information.
Unauthorized access could compromise data confidentiality, and any tampering or unauthorized
modification affects both confidentiality and integrity.

Now, confidentiality may intersect with availability: Rigorous confidentiality measures may
occasionally impact availability, as access controls and encryption mechanisms can introduce
additional steps for authentication, potentially causing delays in accessing information. Overall,
organizations need redundancy planning to mitigate single points of failure in resources.
Adhering to these guidelines can be crucial for maintaining functionality and mitigating risks
associated with availability.