ASSIGNMENT-2 Q2 (Course Name- Cyber Security) (Course Code - PUMC-207)

Assignment Submission

Course: Cyber Security (Course Code - PUMC-207)

Topic: Assignment 2, Question 2 — Foundations of Information Security & Core Concepts

1. The Foundations of Information Security: The CIA Triad

The discipline of Information Security (InfoSec) is built upon a bedrock of established principles designed to protect digital and physical information assets. As the digital landscape evolves with cloud computing, artificial intelligence, and interconnected global networks, the foundational frameworks of InfoSec remain remarkably constant. At the heart of these frameworks is the CIA Triad, which is universally recognized as the core model for designing, implementing, and evaluating information security policies and technical controls. It outlines the three primary, indispensable objectives required to safeguard data and IT infrastructure against unauthorized access, compromise, destruction, or disruption.

A. Confidentiality

Confidentiality is the principle of ensuring that highly sensitive information is accessible only to authorized individuals, entities, or automated processes. It acts as the digital equivalent of a sealed envelope, preventing the unauthorized disclosure of data. In an era plagued by data breaches and corporate espionage, confidentiality is paramount for protecting personally identifiable information (PII), intellectual property, and classified government data.

Mechanisms: Achieving confidentiality requires robust cryptographic protocols (such as AES-256 encryption for data at rest and TLS 1.3 for data in transit), multi-factor authentication (MFA), data masking, and strict access control lists (ACLs).
Example: In the healthcare sector, encrypting patient health records in a centralized database ensures that even if a malicious actor exfiltrates the database files, the data remains unreadable. Only the treating physicians and authorized medical staff possessing the correct cryptographic decryption keys can access the plaintext files.

B. Integrity

Integrity guarantees that data remains accurate, complete, consistent, and untampered with throughout its entire lifecycle. It protects information from unauthorized modification, deletion, or corruption, whether intentional (by a malicious hacker) or accidental (due to a hardware failure or human error). Trust in digital systems is entirely reliant on data integrity.

Mechanisms: Security professionals utilize cryptographic hash functions (such as SHA-256), digital signatures, checksums, and immutable version control systems to detect any unauthorized alterations to files or data streams.
Example: When a user initiates an electronic funds transfer through a banking application, the system verifies the digital signature and the cryptographic hash of the transaction payload. This guarantees that the destination account number and the transfer amount were not maliciously altered while the data was in transit over the network.

C. Availability

Availability ensures that authorized users have timely, reliable, and uninterrupted access to critical information systems, applications, and resources precisely when they are needed. A perfectly secure system is useless if legitimate users cannot access it to perform their business functions.

Mechanisms: Maintaining availability involves deploying redundant hardware components (like RAID storage arrays), load balancers to distribute traffic, DDoS (Distributed Denial of Service) mitigation services, automated off-site backups, and establishing geographically diverse disaster recovery (DR) sites.
Example: An e-commerce platform anticipating massive traffic during a holiday sales event will deploy cloud load balancing, content delivery networks (CDNs), and auto-scaling server groups to prevent website crashes, ensuring the platform remains available despite the surge in consumer requests.

2. Core Information Security Concepts

Beyond the CIA Triad, a comprehensive Information Security program relies on several core operational concepts. These concepts dictate how users interact with systems, how organizations manage threats, and how security aligns with broader business objectives.

A. Authentication (Verification of Identity)

Authentication is the initial gateway to any secure system. It is the rigorous process of validating the claimed identity of a user, device, or system component before granting them initial access.

Factors of Authentication: Robust authentication relies on combining multiple distinct factors: something you know (a complex password or PIN), something you have (a hardware security token, smart card, or a Time-based One-Time Password [TOTP] generated on a smartphone), and something you are (biometric identifiers such as fingerprints, retina scans, or facial recognition).
Example: Logging into a corporate VPN requires a user to enter their standard password and subsequently approve a push notification sent to their pre-registered mobile device via an authenticator app. This Multi-Factor Authentication (MFA) drastically reduces the risk of credential stuffing attacks.

B. Authorization (Privilege Management)

While authentication verifies who the user is, authorization determines what that user is permitted to do. It is the process of determining whether an authenticated entity has explicit administrative or logical permission to access specific resources, read specific files, or execute particular system commands.

Principle: Authorization is heavily governed by the Principle of Least Privilege (PoLP), which dictates that users should only receive the bare minimum permissions necessary to perform their specific job duties, and nothing more.
Example: An authenticated junior accountant successfully logs into the enterprise resource planning (ERP) software. Their authorization profile allows them to view company financial reports and input daily ledgers, but strict authorization policies block them from executing salary payouts or deleting financial history.

C. Accountability (Non-Repudiation & Auditing)

Accountability is the security concept ensuring that every action executed on a network or system can be definitively traced back to a specific, unique user or system entity. This establishes "non-repudiation"—meaning individuals cannot falsely deny having performed an action, such as sending an email or deleting a file.

Mechanisms: Accountability is enforced through comprehensive audit logs, centralized Security Information and Event Management (SIEM) logging, digital signatures, and privileged session recordings.
Example: A forensic investigation into a data leak relies on audit logs, which definitively record that a specific User ID (e.g., admin_42) authenticated and downloaded a sensitive database backup at 02:15 AM from the external IP address 192.168.1.100.

D. Risk Management

Absolute security is an illusion; therefore, organizations must systematically manage risk. Risk Management is the continuous process of identifying, assessing, responding to, and monitoring risks to organizational information assets. The ultimate goal is to balance business productivity and operational costs with appropriate security controls.

Phases: The lifecycle includes Risk Identification (finding vulnerabilities and threats) → Risk Assessment (calculating risk by multiplying the Likelihood of an event by its potential Business Impact) → Risk Response (choosing to Mitigate, Transfer, Accept, or Avoid the risk) → Continuous Monitoring.
Example: A hospital identifies the risk of a ransomware attack leading to a massive database loss. They assess the impact as catastrophic. In response, they implement automated, immutable off-site cloud backups (Risk Mitigation) and purchase comprehensive cyber liability insurance (Risk Transfer) to cover potential financial damages.

E. Security Governance

Security Governance provides the strategic direction for an organization's cybersecurity posture. It represents the overarching framework of corporate policies, executive leadership, organizational structures, and compliance standards that ensures the information security strategy perfectly aligns with enterprise business goals and legal regulations.

Components: This involves drafting corporate security policies, ensuring alignment with international compliance standards (such as ISO/IEC 27001, the NIST Cybersecurity Framework, or GDPR), providing CISO (Chief Information Security Officer) leadership oversight, and conducting continuous internal and external auditing.
Example: A corporate board of directors establishes a mandatory, company-wide Data Protection Policy. This executive governance ensures that all global IT operations comply strictly with international data privacy regulations, avoiding severe legal penalties and protecting the corporate brand.

F. Access Control

Access Control is the practical implementation of authentication and authorization. It is the selective restriction of access to data, physical server rooms, or computing systems. Organizations deploy different access control models based on their specific security and operational requirements:

Mandatory Access Control (MAC): A highly rigid, centralized model where access permissions are defined by strict security labels (e.g., "Top Secret") assigned to both users and files. It is primarily used in military and defense environments where strict compartmentalization is required.
Discretionary Access Control (DAC): A flexible model where the creator or owner of a resource has full discretion to grant or revoke access permissions to other users. This is commonly seen in standard operating systems (like file permissions in Linux or Windows).
Role-Based Access Control (RBAC): Access permissions are not assigned directly to individual users, but rather to predefined organizational roles (e.g., "HR Manager", "Senior Developer"). When an employee changes jobs, their role is updated, automatically granting them the correct new permissions.
Attribute-Based Access Control (ABAC): The most dynamic model, which grants access based on a complex evaluation of attributes belonging to the user, the resource, the specific action, and the environmental context (e.g., a policy that only allows access to financial data if the user is in the Finance department, accessing it during standard working hours, and connecting from a known corporate network IP address).

Conclusion

The CIA Triad—Confidentiality, Integrity, and Availability—forms the absolute, unshakeable core foundation of information security. Surrounding and supporting this triadic framework are the essential operational pillars of security. Authentication mathematically verifies user identity, Authorization rigidly defines user bounds, and Accountability ensures that all system activity is traceable and undeniable. Access Control manages these privileges dynamically, while Risk Management ensures the organization cost-effectively balances defense investments against real-world threats. Finally, Security Governance acts as the guiding hand, ensuring that all technical and operational security practices remain strategically aligned with overarching corporate goals and legal mandates. Together, these elements forge a comprehensive, resilient information security posture capable of withstanding the complexities of modern cyber threats.