Question

a. Define the CIA security model components using your own words?

b. Provide an example in which each of the components are violated?

c. Who is responsible for CIA provide a scenario explaining his role?

Answer 1

CIA is a guideline for information security. Confidentiality refers to the set of rule that limits the access to information. Integrity is assuring that the information is trustworthy and accurate. Availability is the guarantee of access to the authorized people.

Confidentiality: Confidentiality is assuring that the information reaches the right people and preventing its access from the unauthorized people.

For the given scenario confidentiality is preventing the access of data from the unintended user. This is achieved by granting access to the various users at different levels. Only the legitimate user can view or update database.

Integrity: Integrity includes maintaining the consistency, accuracy and trustworthiness of data. In transit data must not be changed. This is achieved by user access control. All the transaction in the database must be atomic and complete. There should not be any partial update of data.

E.g. For the given scenario if there is any change in the bikeBreakType attribute of table ServiceProduct for the user ‘xyz’, relevant update must also be done in bikeBreakType attribute of UserDemo table.

Availability: Availability is making the data available to its users. It includes maintaining all hardware, proper functioning of DBMS server, upgrading the system etc. The idea is the system must not go down, it should always be available for the end user. Proper Disaster recovery plan should be adopted.