Question

Morality is about basic principles and ethics is the application of those principles to guide human behavior.  Crime is defined by law.  Law is established by morality, ethics, and politics.  Politics is about power relationships.

Search the internet to find an example of an activity or situation that represents a network security problem, crime, or issue.

Apply relationships among morality, ethics, law, and crime in the case that you have found. With respect to your example, how do morals, ethics, and law intersect?

What tensions or conflicts do you identify among the three realms, CONFIDENTIALITY, INTEGRITY & AVAILABILITY?

Answer 1

Confidentiality, Integrity and Availability, also known as the CIA triad, is a model designed to guide policies for information security within an organization. These elements of the triad are considered the three most crucial components of security.

Confidentiality:

Confidentiality is also called as Privacy. Measures undertaken to ensure confidentiality are designed to prevent sensitive information from reaching the wrong people, while making sure that the right people can in fact get it. Access must be restricted to those authorized to view the data in question. It is common for data to be categorized according to the amount and type of damage that could be done should it fall into unintended hands. More or less strict measures can then be implemented according to those categories.

Sometimes safeguarding data confidentiality may involve special training for those privy to such documents. Such training would typically include security risks that could threaten this information. Training can help familiarize authorized people with risk factors and how to guard against them. Further aspects of training can include strong passwords and password-related best practices and information about social engineering methods, to prevent them from bending data-handling rules with good intentions and potentially disastrous results.

A good example of methods used to ensure confidentiality is an account number or routing number when banking online. Data encryption is a common method of ensuring confidentiality. User IDs and passwords constitute a standard procedure; two-factor authentication is becoming the norm. Other options include biometric verification and security tokens, key fobs or soft tokens. In addition, users can take precautions to minimize the number of places where the information appears and the number of times it is actually transmitted to complete a required transaction. Extra measures might be taken in the case of extremely sensitive documents, precautions such as storing only on air gapped computers, disconnected storage devices or, for highly sensitive information, in hard copy form only.

Integrity:

Integrity involves maintaining the consistency, accuracy and trustworthiness of data over its entire life cycle. Data must not be changed in transit, and steps must be taken to ensure that data cannot be altered by unauthorized people. These measures include file permissions and user access controls. Version control maybe used to prevent erroneous changes or accidental deletion by authorized users becoming a problem. In addition, some means must be in place to detect any changes in data that might occur as a result of non-human-caused events such as an electromagnetic pulse (EMP) or server crash. Some data might include checksums, even cryptographic checksums, for verification of integrity. Backups or redundancies must be available to restore the affected data to its correct state.

Availability:

Availability is best ensured by rigorously maintaining all hardware, performing hardware repairs immediately when needed and maintaining a correctly functioning operating system environment that is free of software conflicts. It’s also important to keep current with all necessary system upgrades. Providing adequate communication bandwidth and preventing the occurrence of bottlenecks are equally important. Redundancy, failover, RAID even high-availability clusters can mitigate serious consequences when hardware issues do occur. Fast and adaptive disaster recovery is essential for the worst case scenarios; that capacity is reliant on the existence of a comprehensive disaster recovery plan (DRP). Safeguards against data loss or interruptions in connections must include unpredictable events such as natural disasters and fire. To prevent data loss from such occurrences, a backup copy may be stored in a geographically-isolated location, perhaps even in a fireproof, waterproof safe. Extra security equipment or software such as firewalls and proxy servers can guard against downtime and unreachable data due to malicious actions such as denial-of-service (DoS) attacks and network intrusions.

Examples for Security Beach:

1. Missing software updates and patches:

Intruders/Hackers can take advantage of vulnerabilities in operating systems (OS) and applications if they are not properly patched or updated. This puts all of the data on those system and other connected systems at risk.

Recommneded practices:
Make sure all the systems connected to the network/Internet have all necessary operating system (OS) and application security “patches” and updates.

2. Computer infected with a virus or other malware:

Computers that are not protected with anti-malware software are vulnerable. Out-of-date anti-malware may not detect known malware, leaving your computer vulnerable to infection.

Recommneded practices:

Install anti-malware software and make sure it is always up-to-date. Don't click on unknown or unexpected links or attachments. These can infect your computer. Don’t open files sent via chat/IM or P2P software on a machine that contains restricted data – these files can bypass anti-virus screening.