Attack Threats & The CIA Triad

0:00In this nugget, we're going to be talking about attack threats because we know in the world of cybersecurity, there's all kinds of attacks that can be carried out. And these are various threats. And we're going to start by setting a foundation. We'll talk about what a threat is versus what a vulnerability is versus what an exploit is. And once we do that, we'll start talking about these attacks. So let's get started. All right. So here we are setting the foundation. That's what we're going to do. And that's because we're going to talk about the difference between a threat, a vulnerability, and an exploit, just so that we're all on the same page here. So a threat, this is any potential danger. Okay. So it's danger to an asset. So this could be hackers, malicious employees. Yeah. Because there are such things as insider threats, malware, phishing, and the list goes on. These are all potential, that's key word there, potential dangers to assets. So that's what a threat is. Now, vulnerability is a little bit different.

0:58Vulnerability is a weakness, and that is in a system or software. Things like misconfigurations, poor coding practices, hard-coded passwords, that's a real bad one, or weak passwords, just as bad, bugs, using weak encryption, all these things are vulnerabilities. And you know what? The good thing about vulnerabilities is we can fix them. That's right. We can have good coding practices. We can make sure we're not using weak passwords. We're fixing any bugs that are found. We're not misconfiguring things. So these are something that we can address. This is something in our control. Now, a threat, that's not something in our control. So we really don't like those.

1:42All right. Lastly, how about an exploit? So when it comes to exploits, this is any way that an attacker can take advantage of a vulnerability to bypass the security of that system. So what they can use as exploits, usually it's some type of software, oftentimes a tool, and often techniques. So this is how they exploit it. So we've got our bad guys out there who identify vulnerabilities, and then they try to exploit them to gain access. So these are the foundational terms you really need to be familiar with, threats, vulnerabilities, and exploits, and of course what each of them is. All right. Moving on. We're going to now talk about various types of attack threats. So these are those threats out there. And the first one is malware. So when it comes to malware, there's different types. The first one is a virus. Now, we all have heard the term virus, but really what is a virus? Well, it's software designed to cause harm to a system. All right. That's pretty straightforward there. And it could be something on the system, like an application or a service that's running. But the thing is, it needs something.

2:55It needs a system to infect, and this is a key part here, human interaction. So this is when somebody clicks and installs something they shouldn't, or let something run they shouldn't, and it creates an incident where a virus is unleashed upon a system. Okay. So that is viruses. That's our first one. A second type of malware, Trojans. Now, Trojans are disguised as legitimate software. Okay. And they require user interaction. And oftentimes they'll create a backdoor or install malware, something like that. So we've got our little Trojan horse down there. We've got a virus over here. Okay. So again, this needs human interaction in order to do what it does. Okay.

3:41But it's disguised as legitimate software. All right. Next up, we have rootkits. Now, this is software that hides deep in the operating system, and it works to avoid detection. So really what this is, this is a backdoor that's implanted by a bad guy. Could be done through a Trojan or a virus, but it gives the attackers persistent control. And that just means they maintain control. And oftentimes they'll reach out to what we call a C2 server. That's a command and control for direction. So the idea is if we had a computer down here and it had that rootkit in it, well, what it would do is if we had out here in the cloud somewhere, we had a C2 server, it's going to reach out and check in every so often. It might be every 30 minutes or an hour or something like that. And it's going to say, hey, do you have anything you want me to do? And there might be a command come back to, yeah, I would like you to create this user account with this password, with these permissions. And the rootkit can do that on the device. So it's all kinds of things like that. So rootkits are very, very dangerous. So lastly, as far as malware class of threats, we've got worms. That's right. So worms are similar to viruses. However, there's a big

5:03differentiator. They can self-replicate between systems with no human interaction. That's not good, right? Absolutely not. So if a worm is introduced into an environment, it can then self-replicate between hosts in that environment. So what do we do to protect against these? Well, we're going to need some type of endpoint protection. All right. That's what's really going to help us here as one layer. Because really, when it comes to security, we practice something called defense in depth. So we'll say in depth. And what that means is you have different layers. So you've got maybe a firewall, an IPS. You could have your endpoint protection software. You can have email filtering software, web filtering software. But the idea is with defense in depth, we have all these different layers. And endpoint protection is one of those layers. And this could be something like the Cisco Secure Endpoint. OK. And that's formerly known as AMP. Just for reference, if you've heard of AMP before. Well, now Secure Endpoint is what Cisco uses for their endpoint protection. So there you go. That is our malware and the various types of

6:19malware. OK. Next up, we're talking about malware payloads. So what is a payload? Well, if you think about it, just think about, well, like a B-52 bomber or something. Well, what we do is we have this bomber out here. It's going out. And it's going to drop some bombs somewhere. That's what it's supposed to do. So what happens is they fly along. And when they get there, they drop there. That's right, the payload, which are the bombs which go boom. OK. So if you think of the aircraft as the hacker or attacker, well, they've got payloads and those payloads are what go boom, except they don't actually explode necessarily, but they do things. It could be creating accounts. It could be assigning permissions. It could be pulling file hashes or pulling password hashes off of systems. But the idea is when there is a type of virus or it could be a Trojan or even a worm, the idea is what these do is they carry a payload. So once they are delivered onto a system, it could be a user interaction or with worms. It doesn't have to be user interaction. Well, you're going to then run

7:34that payload. That's what these viruses and Trojans and worms could do. They use that payload and it is executed on the endpoint where that malware is installed. OK, so that's the idea of a payload. Super. Now, here we go. Yes, we're going to talk about TCP, the protocol here, transmission control protocol, TCP. Now, why on earth are we talking about TCP, Bob? This is security stuff. What's TCP got to do with anything? Well, I'll tell you, there's a certain type of attack called denial of service or distributed denial of service, and it helps to understand how TCP works so you can understand how those attacks work. Now, if you're not familiar with TCP and this is a layer four or transport layer protocol because you've heard of UDP as well. Well, this is the TCP and of the TCP UDP dynamic duo. So here we're talking about TCP transmission control protocol.

8:35Now, this is what's called a connection oriented protocol. And what that means is before data is passed, there's a handshake that takes place. A connection is established or oriented before data is sent. So if Bob wants to talk to Lois, what he's going to do, well, his system is going to do this. He's not personally. All right. But when he clicks on something that wants to communicate with Lois's server over here, well, it's going to go out and it's going to send what we call a SYN packet. OK. And that's basically saying, hey, I'd like to talk to you. OK. And Lois's server is going to send back something called a SYN AC packet. All right. So Lois's server is then saying, OK, yeah, sure, we can talk. Let's get started. And so then Bob's system is going to send back to Lois's server a final acknowledgment packet saying, all right, we have established this what's called a three way handshake because we have three actions that took place here.

9:41And at this point, we have what's called a session and we can start to pass data back and forth. OK. So that's how TCP works.

0:00Now we're going to talk about a certain type of attack that I had alluded to just a minute ago, and that is denial of service and distributed denial of service. So let's talk about how these work. Now there's multiple ways that these can work, but one of the most common types is called a TCP SIN flood. So if I do TCP SIN flood, that's what that's called, and this is just one example of a type of denial of service or distributed denial of service. So let's talk about how this works. So you've got the attacker over here and his target over here. So what will happen is they'll send a SIN packet across, all right, and the server sends back, of course, a SIN ACK, but the attacker never sends the final ACK. That does not happen. So what this does is it, when this server over here, the target sends that SIN ACK, it leaves that open and listening, so it's got this ear over here, it's listening for that final ACK to come back. And the idea of this being open and listening, guess what it's doing? It's using resources, and we're talking about is like CPU and memory, more specifically. Okay. So the idea is in a TCP

1:21SIN flood scenario, the attacker here is going to send maybe, who knows, like 100,000 SINs, all within a very, very, very short period of time. We're talking just a few seconds. So it's going to flood this target full of SINs, and it's going to respond to them all with SIN ACKs, and everyone is going to use up a little tiny bit of resources. But when you've got 100,000 tiny little resources being used up, you might max out their CPU and memory, which is going to cause that server to not be available for service. At that point, there's no resources left. So it's basically, at this point, just kind of stuck. It can't respond to anything. It has no resources available to use. Well, this is one example of a denial of service. The idea here with a DOS attack or denial of service is an attacker is going to try to use up as much resources on a target as it can so they can no longer respond to valid service requests. Okay. Now, a distributed denial of service, the only difference is when you have a standard denial of service, it's usually one attacker in one point going to a target. So let's say our target could be right over here.

2:33Here's our target. Okay. And our attacker is over here. Well, it's one attacker to one target. And there is a limit on how many SINs that one device can send within a short period of time, of course. But the distributed part means there are multiple attackers. Okay. So we've got some over here, some over here, some over here. I'll put them all over the place. And guess what? They're all attacking multiple from a distributed attack source. Okay. And a lot of times, this is using something called a botnet. And a botnet is basically where an attacker will go out and infect several machines with malware. And they're going out and connecting to the C2 server, like we talked about. And it's going to say, hey, I want everybody at noon Greenwich Mean Time. So at noon GMT, I want you to go attack this host, this target over here. So what's going to happen at noon? They're all going to strike out and try to use up all the resources on this target so that it can no longer respond to valid session requests. So that's denial of service and distributed denial of service. All right. Super. Let's move on. Next up, we have a man in the middle attack. So MITM, as it's abbreviated, or it's also known as an on path attack. And that's

3:52because the attacker is on the same path or trajectory as that data flowing through the network environment. So this is where an attacker places themselves in the middle of a conversation between a target and whatever resource that target is trying to access. So there's different ways that this can happen. One of the ways is something called ARP spoofing. Okay. So if this attacker could get on the same local network as the target over here, his machine can send out spoofed ARP messages so that this attacker's computer to the rest of the network appears to be the default gateway. Okay. So that all traffic's going to be routed through it. And then the attacker's machine will route it through the actual, you know, router or firewall or whatever.

4:42And the attacker becomes basically a proxy, which can then see all that data. You got it. Okay. So that is an on path attack or man in the middle attack. But you say, what do you mean you can see the traffic? What if we're talking about HTTPS traffic? It's secure, right? Well, yes, it is. Except there's an attack called SSL stripping. And that's where, let me change colors here. That's where this all takes place like we see here, except when the attacker forwards this traffic, the original request is going out to HTTPS dot dot slash slash some website. Okay.

5:24All right. So what happens is during the SSL stripping process, the S gets removed from the request before it's forwarded. Then it's forwarded as an HTTP request. Okay. So that's called SSL stripping. And that way we've got that eyeball down here seeing all the traffic coming across. So this is a man in the middle attack. Now there's several different ways this can happen. Using ARP spoofing and SSL strip is just one of the techniques used to do that. All right. Now let's talk about data breaches because we just need to really make sure we're all on the same page as far as some certain terms. Now, a data breach is unauthorized access to sensitive data and not just sensitive data, really any data. And again, the key here is unauthorized. So this would be a data breach, especially when it comes to things like, you know, your customer records.

6:22Yeah, that's a lot of personal or private or sensitive information. Could be credit card numbers. It could be medical data, things like that. But there's also other types of breaches because this here is known as a data breach, but there's other types of breaches such as account compromise. That's a type of breach where an account is breached itself or the identity that users credentials. Okay. Also a system breach. And this is just where an attacker's gain access to any system or even security breach. And this is basically just a generic term for any kind of security related breach. So a data breach, an account compromise system breach, they could all be called a security breach, but a breach is just something we really don't want to happen.

7:17All right. At this point, we're going to go ahead and take a break and we will continue in the next nugget with insecure APIs. So I'll see you there shortly.

0:00All right. Welcome back. And now we're continuing with our attack threats and we're looking at insecure APIs. And an API is an application programming interface. And if you're not familiar with what an API actually is or what it does, it basically allows you to use web traffic or web commands in order to interact with some type of program or service. Okay. So you don't have to use a web UI or PowerShell. You could use something called an API. And this is used a lot between applications. So if you had this app over here, app one, and your business uses that all the time, and maybe they use it for inventory and you had a sales system over here, and this is used by the company. There we go. Sales. And you might configure these to use APIs in order for the sales to talk to the app one to identify how much inventory is available. And then you might have a separate system that's used for purchasing. Okay. And so the sales API goes out and checks the inventory because somebody just sold a thousand widgets. Okay. We're big on widgets.

1:11Okay. But we only have 900 in inventory. Well, then what we need to do is sales could use an API to talk to the purchasing software platform and say, hey, we need to make sure we have enough material on hand. So go purchase this material for a hundred more widgets. That way we can go ahead and make this sale complete and we can provide the customer with the resources, their widgets. So that's what an API is. And here's an example of one right here. So it's really simple. Get. Get just gets data. Put is another command. So put, well, as you can imagine, it puts data.

1:47So here, for example, with the sales to the app one, this is a get. We're getting some information here. Here, we're doing a put. We're putting information into that database. So we know we need to purchase material for a hundred more widgets. All right. So this is an example of what an API does. Okay. So we're talking about insecure APIs. Well, these APIs run as code on these various applications or systems. And if proper secure coding isn't being used, then there can be weaknesses. For example, authentication. We want authentication to happen. So when the sales goes over to request information to do a get from app one, how does app one know that it's actually the sales application we use and not something else?

2:36Well, that's where we need authentication. So weaknesses or insecure APIs often have no authentication, and that is a big no-no. Okay. Or these APIs might be a little loose. Okay. And what I mean by that is they return more data than needed. Okay. For example, when our sales down here goes across and talks here to our app one to get that inventory count, well, instead of just returning 900 because that's what we need to find out what's our inventory of widgets, it not only returns 900, but maybe it also returns a bunch of other information along with it. So it's being a little chatty, if you know what I mean. All right. And then lastly is poor input validation.

3:24And I want to spend a couple minutes talking about input validation and what that is. And that's because any time you have a system or application that is ingesting data from a user like here, it's not from a user, but it's from another system. If that data being put into that field, so if we had a field here for let's say username and one for password, if we're not checking to make sure that malicious code isn't being entered into here, then an attacker could actually put commands in here. And once they press the enter button down here to submit their username, password, which is actually malicious code in these fields. If the program doesn't validate that input and make sure it's not malicious, then you could actually run commands against systems.

4:16Okay. So yeah, that's really bad. And you're going to see as we go and talk about code and insecurities and applications and such, one of the biggest problems is that developers aren't using input validation. So they have poor input validations, which allows attackers to inject malicious code into systems and applications. Not a good thing, right? Absolutely not. Because within this API call here, maybe I included some extra commands after this, and it's going to go ahead and run them. Well, that could be a possibility. So this is just another threat we need to be aware of. All right. Next up is compromised credentials. Well, well, well. So this is when an account is compromised. The attacker gets the password basically for this username. So we'll have our username and password. And guess who got that? That's right. Our bad guy. Okay. Now, how did this happen? Well, the most common type is phishing. So a phishing email with a link that goes to, you know, msonline dot, dot, dot, dot, dot. At least that's what it looks like. The user clicks on it. They get what looks to be a valid, maybe Microsoft website. They put in their credentials

5:35and bada bing, bada boom, bad guy gets it. Okay. So that's one way phishing and actually probably the second most common way. The first most common way is simply weak passwords. Okay. So an attacker, they can go out and get your username. And that's just because it's probably the same as your email address. So they can pull that off of anything. Okay. And then they find your company's portal or something, and they begin to try to log in with your account. So you've got your username over here and the bad guy is then going to try a list of well-known passwords, things like, you know, summer 2024 exclamation point. And then in 2025, that gets to change 25 and in 26, they changed it to 26. You know, this is a very weak password and very common, unfortunately. So the attackers out there know that they have like the top 10 or 20 or a hundred most commonly used passwords. And what they'll do is just use code or an application to go try to log in with your username and a password off this list. Right. And that is a type of brute force password attack. Now they'll only do it like once every 10 minutes or 15 minutes. So as to not

6:53lock your account out. Now it takes time, but you know what? It is effective. Now, another way, actually, I'm going to make some room here. So grab a screenshot if you want to, before I go erasing here, I'm going to grab this and we're going to get rid of that. All right. I need to make room for something because we're going to talk about another type of compromise credentials. And this is known as token theft. All right. So how this works is when you sign into an online portal or something, oftentimes you get what's called a token and it goes into your browser and it allows you to maintain authentication. So you don't have to log in every 15 minutes or something. Right. So you get this token on your system. Well, what happens is bad guys can use tools. One of them is called evil jinx. I'll put that in here. Evil G I N X evil jinx. And basically they send a fish to a user and it contains a link to an evil jinx server. All right. Now what this is, is basically this will look like an authentic website. So let's just go again with our Microsoft login. It's so super common. So we've got our, our login page here where the user's going to enter their credentials. So what happens is when they fall victim to this, they go to the website

8:12and you know what? It looks absolutely authentic. Well, that's because you can just clone a website, not difficult. Okay. So when they do that and they send their username and password over here to this website, well, evil jinx then forwards that to the real website. So we'll say real Microsoft website and then becomes a proxy at this point. So then the results come back and then it goes like that. Okay. But here's the thing. What about multi-factor authentication? Well, since evil jinx is the proxy, it can pass that information to this website. So it is actually going to allow the MFA to take place and once that happens, the token, remember our token we're talking about here, we've got a little token right here, is sent through evil jinx back over to the user. And guess what? The evil jinx user now have your token, which means they can authenticate without using MFA to your account.

9:12What? Yeah, it's pretty darn dangerous. So this is just another type of compromised credentials. Super duper. Let's keep rolling on. Here we go. PQC, post quantum cryptography. Yeah. So we're talking here, post quantum crypto. So what is this? Well, if you think about quantum computing, the idea is that we're going to have these computers over here that can perform absolutely mind-blowing equations and solve problems at just unheard of speeds, just things we've dreamt about.

9:46Well, the problem with this is if it's that good, it's going to be able to break our encryption that we use today within a few seconds, if that long. So that means if quantum computing is actually realized at this point in time, well, we would have no data privacy. You couldn't protect your data. There's no such thing as confidentiality anymore, because all crypto has been broken. So what we're talking about is post quantum.

10:19So the idea is we need some type of cryptography that will survive quantum computing. And there's a few different types here. One is called lattice-based cryptography. Another one is hash-based signatures. Another is multivariate quadratic equations. And finally, code-based schemes. We're not going to go into each one of these. The idea is you need to be aware of this situation. This is a threat, absolutely. And now it's not an attack per se, but it's a threat that if quantum computing is realized before we have something like this in production and available to us to use on our systems and devices, well, that's a threat. Okay. So that is post quantum cryptography. All right. At this point, we're going to go ahead and take another break, and we'll be back with some more attack threats. See you there shortly.

0:00All right, we're back and it's time to go ahead and finish up our attack threats. I've got a couple more to go through. The first one is attack threats that AI faces. Pretty interesting. All right, let's get to work here. So what do we have? Well, one of the threats is called data poisoning and this is where an attacker poisons the training data used to train that AI model. Okay, so if you're not familiar with AI and different models and such, the idea is that it's not a simple program that knows all this information. That program that was created has to be trained. So what happens is you have various training models that are used to train the AI, just like you would train a new employee on how to do something. The same thing. These AI models are trained for something specific. Okay, so if an attacker could gain access to the training models, well, guess what? It could modify those model behavior to make that model actually bias and make incorrect predictions. Yep, so that's a bad thing, right? It sure is. And that's known as a targeted data poisoning attack. There's also an exploratory data poisoning attack and that just

1:18looks to degrade the model's performance so that it's just really not usable. So when it comes to the targeted here, let's focus on that for a minute because I want you to think about this. What if you could gain access to a company's training models for their AI that is used in their endpoint protection software? Well, if you could do that, you could actually tell it or train it to realize that XYZ type of piece of software is actually safe. In reality, since you as the attacker are changing this training model, you the attacker could then use XYZ software to attack an endpoint. And this AI model over here used in the endpoint protection software is going to think that our XYZ software down here is safe, when in reality it's not.

2:16So yeah, that's a pretty bad thing as you can imagine. So okay, let's go ahead and wrap up this here. We got four more to look at here and we have your adversarial attack and that's where you're tricking the model into making incorrect decisions just like we talked about with our targeted data poisoning attack. You've also got model inversion attack and this uses the outputs from an AI model to infer details about the training data. So here we're trying to figure out what training data is being used and also is that training data public or is it private? Because if it's public we can kind of figure out how it's learning and maybe figure out ways around it or how to trick it.

3:02Okay, there's also model stealing and that's basically just creating a copy or a clone of that model, so the AI itself. So again you'd be able to study it in depth and figure out ways to get around the rails it has put in place for safety. And then lastly an AI trojan attack, also known as a back door attack. This is where the attacker will inject malicious behavior into the model and the attacker can trigger that at will. So that's why it's a back door because it sits there and until the attacker provides a certain input to that AI model and then it will go ahead and trigger that to do whatever the attacker has designed that attack to do. So there you go, those are attack threats that our AI faces. Okay, let's go ahead and wrap this up with common threats against location types.

3:52So here as far as location types, you've got on-premise, cloud, and hybrid. Now I do want to say really this comes down to where do the services reside. Because if it's a service on-prem then any type of attacks that are against that service, it doesn't matter where it's at, it's going to be there. If it's on-prem, it's in the cloud, if it's hybrid, it doesn't matter. So this is just kind of your rule of thumb right here. It's where that service resides. So let's take a look at this.

4:23For on-prem, these are some of the common types of attacks. You've got viruses, malware, denial of service, distributed denial of services, phishing, rootkits, man-in-the-middle, SQL injection, cross-site scripting, which we haven't got to yet. We will get to those, don't worry. Okay, so those are some common types of attacks. But in reality, if you think about it, if you're a SQL, because here we're talking about SQL injection, so it's an attack against a SQL database server. Well, if your SQL server is on-prem, then yeah, it's on-prem. But what if it's in the cloud? Well, then obviously it's going to be attacked in the cloud. So again, it just goes back to where your services reside. So here with the cloud, we see data breaches, insecure APIs, because yeah, cloud uses a lot of APIs, and you got your DOS and DDoS, and of course, compromised credentials. Could you have compromised credentials on-premise? Yeah, if you're AD servers, you're using Active Directory for your identity service provider. Well, if it's on-site, well, then your compromised credential is going to be part of on-site as well. But if your SQL injection is on the SQL server in the cloud, then yeah, your SQL injection is going to be in cloud. So this is not by any means an exact science as to what type of attacks take place where, because you could have API attacks on-prem. It's possible, yeah, absolutely,

5:40if your systems are talking back and forth via API and somebody gets in there and starts intercepting traffic and figures out what's going on, absolutely. All right, let's wrap this up with hybrid. So there's your answer. Pretty simple and straightforward. It's a combination of both. Well, of course it is, because you have a combination of on-prem and the cloud. So it's your combo pack. There you go. All right, that wraps up our attack threats. Awesome, we got through that. All right, next up, we're going to talk about one of the most important things you should understand in cybersecurity. I'm telling you, this is foundational and it's called the CIA triad.

6:15So I'll see you there shortly.

0:00Now we're talking about the CIA triad. So tri, meaning three, there are three sides to this triangle or triad, and they are confidentiality, that's our C, integrity, that's our I, and availability, that's our A. And I mentioned at the end of the last nugget that the CIA triad is one of the most important things you should know in cybersecurity. It's basically a foundational cybersecurity model, and it's designed to guide security policies within an organization. So it really focuses on three core pillars. And again, that's our confidentiality, our integrity, and our availability. So let's jump into each one of these. Okay. So when it comes to confidentiality, this ensures that sensitive data is only accessible to authorized individuals. So here we're looking for authorized access. We want to make sure that there is no unauthorized access.

0:59We need authorized access. Now, what does this mean? Well, when it comes to confidentiality, it means that when we have data, so let's put our server over here, here's our server, and we've got some data on that server right here, there we go, that we need to protect it accordingly. What does that mean? Well, authorized access. How do we authorize folks to access data on our servers? Well, oftentimes we have roles or permissions, and that's how we control who can access what. Because we've got our users up here, and it's also known as an identity, the user account that is. So they will be assigned roles and or permissions to access what they need access to. And in this instance, we need to make sure that they only have access to what they need in order to perform their job. That's called the Rule of Least Privilege. Okay. And we need to practice the Rule of Least Privilege. Okay. So that's one way we can focus on confidentiality.

2:06But what about, let's put a server over here, and this is maybe somewhere up in the cloud, and we're going to send data from our on-prem, so let's put on-prem here, up to the cloud. So when we do so, that data is going to transmit across the internet. So the internet up here is unsecure. There is no permissions on the internet. Okay. So your roles and permissions stay on-prem, and they can reside in your cloud as well. But in transit, so this is what we call data in transit, meaning it's in motion, it needs to be kept confidential. How do we do that?

2:46Well, I'll tell you. We use encryption. That's right. Encryption is how we achieve confidentiality when sending data across unsecured networks. Now, when our data is sitting here on our server, it's called data at rest. Okay. And this is data in transit. A couple different states that data can be in. So confidentiality, we need to make sure that only authorized access to the data is happening. We need to make sure it's secure. So when we're encrypting it in transit, any peeking eyes that might be out there who might have the ability to perform network captures, well, guess what? They're not going to see the data because it's encrypted. They can't read it.

3:29They don't have the keys. All right. So that is confidentiality. Next up is integrity. So integrity guarantees that the information is accurate, super important, and trustworthy. Okay. So when data is used or transmitted, we need to know that it was not altered in any way during its transition or use of that data. So we need to make sure it's accurate and trustworthy.

4:01That is the integrity of our data. And because if our data is not trustworthy and maybe it was altered, well, then what good is it? It's not true anymore. It's not accurate. So any work that we do off of that data is wasted time. That's not good. So how does integrity really work? Well, we can, again, we can use our permissions, file permissions to make sure that only authorized individuals have access to the data. Okay. While it's being used, we can also use version control.

4:35Okay. And that's so that we keep various versions. Every time a file is changed or a change made to a database, we track that. So we know that if something was done at one point, we can kind of go back to before that happened and have trustworthy data. And then lastly, we can use checksums. And these are simply basically like a cryptographic hash. And we're going to talk about those a little later on. But the idea is we take the fingerprint basically of that data and we store it. And we say on this date, we'll say on February 4th of 26, the data looked like this. That's the fingerprint. Okay. And then when we go to use it on February 7th of 26, before we actually use it, we take a checksum or basically a hash again, the fingerprint of it. So I get that fingerprint. And if this fingerprint and that fingerprint match, then we know the data has not been altered. Okay. So that's how we can verify data integrity. Super. All right, let's move on to our final. And this is availability. Yeah, it's got to be available. So when we're talking about availability, it means that our data and our resources are accessible to authorized users.

5:49That's what availability is. So for instance, if I had my sales application over here on our company, and something happened to the server and it's no longer available, well, how can we sell anything? I mean, I can't get into the sales accounts. I can't access the information about my clients. I need that information. Well, that's where we come up with some ways to make sure our data and our systems are accessible to our authorized users, because when they're down, that's not good because we lose money when our services are down. We're not able to use them. So what we can do is, well, we maintain our hardware and systems. So basically we're doing maintenance. Okay. For example, we're doing software updates. We're making sure we have a spare hard drive or something in case we need it, or we're making sure that we have backup power. So our systems don't crash when the power goes out, lots of things, but we can maintain our hardware and our software and systems there. Okay. So maintaining them, making sure that they're being taken care of is very important. Also, we need to have backups as you can imagine, because if this server did crash and go down,

7:07well, maybe we could spin up a virtual over here, a virtual machine and restore from backup and be back up and running in 30 minutes. Hey, that's great. Instead of maybe being down for days, we also use something called high availability. And there's simply where, let's say I had this sales server. I wouldn't have just one. I might have two. Okay. So if one goes down, I have another one that can be used. And that goes down into the hardware. As we talk about hard drives and using RAID for hard drives where it provides redundancy. So we have multiple and they work in kind of a cluster so that if one device goes bad, the other two can carry on and we can replace this and it'll rebuild the cluster. So we're good there. Also backup power so that if our power goes out, we can run off batteries or a generator or something. It's all about making sure that our systems and data are available and accessible to authorized users. So as we jump back up to the top confidentiality, we've got to keep that data confidential. Okay. Only authorized users can access it. Integrity, making sure our data is trustworthy so that we can use it. Availability.

8:16Well, we can't use it if it's not available, making sure our services and systems and data are up and running and available. That is the CIA triad. That's what information security and cybersecurity is all about. Protecting these three key pillars. All right. Well, that wraps up this skill. I hope it's been informative for you and I'd like to thank you for viewing.