8.1 Security Concepts

Key Concepts

• Confidentiality
• Integrity
• Availability
• Authentication
• Authorization
• Non-Repudiation
• Encryption
• Firewalls

Confidentiality

Confidentiality ensures that sensitive information is accessible only to those authorized to view it. This is typically achieved through encryption and access control mechanisms.

Example: Think of confidentiality as a locked diary. Only the owner (authorized person) has the key (access) to read its contents, ensuring that the information inside remains private.

Integrity

Integrity ensures that data remains unchanged and accurate throughout its lifecycle. This is crucial for maintaining the reliability and trustworthiness of information.

Example: Consider integrity as a sealed package. Once sealed, any tampering (unauthorized changes) would be evident, ensuring that the contents remain intact and unaltered.

Availability

Availability ensures that systems, data, and resources are accessible to authorized users when needed. This is essential for maintaining continuous operations and service delivery.

Example: Think of availability as a reliable water supply system. It ensures that water (resources) is consistently available (accessible) to users (authorized individuals) whenever they need it.

Authentication

Authentication is the process of verifying the identity of a user, device, or system. This is typically done through credentials such as passwords, biometrics, or digital certificates.

Example: Consider authentication as a security guard at a gated community. The guard checks IDs (credentials) to verify the identity of visitors (users) before allowing them entry.

Authorization

Authorization determines what actions or resources an authenticated user is permitted to access. It ensures that users have the appropriate permissions to perform specific tasks.

Example: Think of authorization as a keycard system in a hotel. Each keycard (authorization) grants access to specific rooms (resources) based on the guest's booking (permissions).

Non-Repudiation

Non-Repudiation ensures that a party cannot deny the authenticity of their signature on a document or the sending of a message. This is achieved through digital signatures and audit trails.

Example: Consider non-repudiation as a signed contract. The signature (digital signature) on the contract provides proof that the signer (party) cannot later deny their involvement in the agreement.

Encryption

Encryption is the process of converting data into a coded format that can only be read by someone with the correct decryption key. This ensures data confidentiality and integrity during transmission.

Example: Think of encryption as a secret code. The message (data) is transformed into a coded format (encrypted) that only the intended recipient (with the decryption key) can understand.

Firewalls

Firewalls are security systems that monitor and control incoming and outgoing network traffic based on predetermined security rules. They act as a barrier between trusted and untrusted networks.

Example: Consider a firewall as a security checkpoint at an airport. It inspects all passengers (network traffic) and allows only those with valid documents (security rules) to pass through.