Foundations of Information Security

Foundations of Information Security

Why This Question Matters

On a Tuesday afternoon in September 2017, the credit bureau Equifax announced that personal information belonging to 147 million people had been stolen. Names, Social Security numbers, birth dates, addresses, and in some cases driver's license numbers—all of it, copied out of Equifax's systems over a span of two and a half months. By the time the company finished responding, it had paid more than $1.4 billion in costs, settlements, and security improvements. The vulnerability that opened the door was a known flaw in a Java web framework called Apache Struts; a patch had been available for two months before attackers used it.

A single breach can reshape a career, a company, or a country. The 2017 Equifax incident forced the resignation of its chief executive, triggered congressional hearings, and led to new regulations in the United Kingdom and several U.S. states. The 2018 Marriott/Starwood breach exposed data on roughly 500 million guests and went undetected for four years. The 2021 Colonial Pipeline ransomware attack shut down fuel delivery across much of the U.S. East Coast for six days. In each case, the technical details differed, but the underlying pattern was identical: something valuable was protected by something inadequate, and someone took advantage.

These stories raise the question that runs through this entire book: what does it mean to protect information, and how do we do it well enough that the protection holds when it matters? That question sounds philosophical, but it has very practical answers. The rest of this chapter introduces the vocabulary, mental models, and patterns that security professionals use every day. If you internalize this chapter, every later chapter will click into place. If you skip it, the later chapters will feel like a stack of disconnected techniques.

You will learn four things in this chapter. First, the three properties—confidentiality, integrity, and availability—that almost every security decision is designed to defend. Second, who attacks systems and why, because defenses must be designed against specific adversaries. Third, the precise difference between a vulnerability, a threat, and a risk, because confusing those words leads to confused defenses. Fourth, the layered approach called *defense in depth*, plus the modern refinement called *zero trust*. You will finish the chapter by analyzing a real breach report, which is the single best way to make these ideas stick.

The CIA Triad and the Models Built on Top of It

In 1976, two researchers at the U.S. Air Force, James P. Anderson, wrote a report titled *Computer Security Technology Planning Study*. The report's lasting contribution was to formalize three properties that any secure system must protect: confidentiality, integrity, and availability. These three properties, usually grouped as the CIA triad, have been the starting point of every security framework since. If you cannot name which of the three a system is trying to protect, you cannot design a defense for it.

Confidentiality is the property that information is disclosed only to people who are authorized to see it. A password database is confidential. A patient's medical record is confidential. A company's strategic plan is confidential. When confidentiality fails, secrets leak. The Equifax breach was primarily a confidentiality failure—147 million personal records became accessible to people who were not authorized to read them. Encryption, access control lists, and the principle of least privilege are all confidentiality tools.

Integrity is the property that information has not been altered in an unauthorized way. Integrity is sometimes described as "trustworthiness of data." When integrity fails, you cannot rely on what your database tells you. Imagine a banking system where an attacker can change the destination account number on a wire transfer: the message would still be delivered, the system would still respond, and the money would still move—but the transaction would be wrong. Checksums, digital signatures, audit logs, and write-once storage are integrity tools. Many beginners underestimate integrity because it sounds less dramatic than confidentiality, but a single uncaught integrity violation can be more damaging than a leak, because the system continues to operate normally while the data is quietly wrong.

Availability is the property that a system is operational and accessible when needed. A website that returns errors 50% of the time is not really a website. The Colonial Pipeline ransomware attack was primarily an availability failure: the company's billing system became unusable, and although the operational pipeline itself was never compromised, the company shut down delivery because it could not bill for fuel. Backups, redundant systems, denial-of-service protection, and incident response plans are availability tools.

The three properties sometimes trade off against each other. A system that locks down access strictly will be highly confidential but possibly hard to use; a system optimized for ease of access will be highly available but harder to keep confidential. Encryption protects confidentiality and integrity but, if the keys are lost, destroys availability. Recognizing these trade-offs is part of the design skill you will develop over the course of this book.

Beyond the triad: STRIDE and the Parkerian Hexad. The CIA triad is the foundation, but it is not the whole building. Microsoft's STRIDE model, developed in the late 1990s, breaks security into six categories that map cleanly to threats:

• **S**poofing — pretending to be someone or something you are not
• **T**ampering — modifying data or code without authorization
• **R**epudiation — performing an action without leaving a traceable record
• **I**nformation disclosure — exposing information to unauthorized parties
• **D**enial of service — making a system unavailable
• **E**levation of privilege — gaining capabilities you should not have

You will see STRIDE referenced throughout security literature, and you will use it in this book when we analyze specific attacks. The first two letters of STRIDE map directly to confidentiality and integrity; the rest give you a more granular vocabulary for talking about specific incidents.

A second extension, the Parkerian hexad, was proposed by Donn Parker in 1998. Parker argued that confidentiality and integrity are sometimes the wrong level of abstraction. His hexad adds three properties: authenticity (a message is genuinely from who it claims to be from), utility (the information is in a usable form), and possession (someone physically controls the asset—think of a stolen laptop whose data is encrypted but whose owner no longer has it). For web security, you will mostly use CIA, but it is worth knowing that other models exist and that "confidentiality" is not always the same thing as "privacy." A privacy violation, for example, may involve authorized access used for unauthorized purposes—technically confidentiality was preserved, but harm was still done.

A practical way to use the CIA triad is to take any system and ask three questions. What are the confidentiality obligations? What must remain unchanged? What must remain online, and at what level of performance? If you can answer those questions with specifics, you can design defenses. If you cannot, your system is not ready for attackers, because you do not yet know what you are protecting.

Threat Actors, Motivations, and the Modern Attack Surface

Defending a system without knowing who you are defending it against is like designing a car without knowing whether it will be driven in a city or a desert. Threat actors are the people and groups who might attack your system, and they vary enormously in skill, motivation, and resources. A defense that frustrates a curious teenager may be trivial for a nat