Dr. Greg M. Bernstein
Updated October 19th 2021
No, not the U.S. Government Agency
Confidentiality refers to protecting information from being accessed by unauthorized parties. In other words, only the people who are authorized to do so can gain access to sensitive data.
Imagine your bank records. You should be able to access them, of course, and employees at the bank who are helping you with a transaction should be able to access them, but no one else should. A failure to maintain confidentiality means that someone who shouldn’t have access has managed to get it, through intentional behavior or by accident.
From MDN/NIST:
Such a failure of confidentiality, commonly known as a breach, typically cannot be remedied. Once the secret has been revealed, there’s no way to un-reveal it. If your bank records are posted on a public website, everyone can know your bank account number, balance, etc., and that information can’t be erased from their minds, papers, computers, and other places. Nearly all the major security incidents reported in the media today involve major losses of confidentiality.
All HTTP traffic is visible when on the network!
Login Password fields are not encrypted by the Browser!
Number of IP hops from your browser to site?
$ pathping www.grotto-networking.com
Tracing route to www.grotto-networking.com [207.38.86.220]
over a maximum of 30 hops:
0 DESKTOP-NOE6DKP.lan [192.168.1.113]
1 OpenWrt.lan [192.168.1.1]
2 10.0.0.1
3 96.120.89.41
4 te-0-3-0-13-sur04.fremont.ca.sfba.comcast.net [68.87.197.253]
5 68.85.155.49
6 hu-0-16-0-3-ar01.santaclara.ca.sfba.comcast.net [68.85.57.29]
7 be-33651-cr01.sunnyvale.ca.ibone.comcast.net [68.86.90.93]
8 hu-0-14-0-0-pe02.529bryant.ca.ibone.comcast.net [68.86.89.234]
9 96-87-8-2-static.hfc.comcastbusiness.net [96.87.8.2]
10 kanc-b1-link.telia.net [62.115.125.186]
11 stlo-b1-link.telia.net [62.115.143.203]
12 ae3.cr-atlas.stl1.core.heg.com [80.239.133.34]
13 207.38.95.6
14 207.38.86.220The previous traceroute only includes IP routers.
Lower layer switching devices do not show up in trace route including: layer 2 switches devices using Ethernet, MPLS, and Software Defined Networking (SDN) devices
From MDN/NIST:
Integrity refers to ensuring the authenticity of information—that information is not altered, and that the source of the information is genuine. Imagine that you have a website and you sell products on that site. Now imagine that an attacker can shop on your web site and maliciously alter the prices of your products, so that they can buy anything for whatever price they choose. That would be a failure of integrity, because your information—in this case, the price of a product—has been altered and you didn’t authorize this alteration.
From MDN/NIST:
Another example of a failure of integrity is when you try to connect to a website and a malicious attacker between you and the website redirects your traffic to a different website. In this case, the site you are directed to is not genuine.
From Wikipedia
For any information system to serve its purpose, the information must be available when it is needed. This means the computing systems used to store and process the information, the security controls used to protect it, and the communication channels used to access it must be functioning correctly.
Ensuring availability also involves preventing denial-of-service attacks, such as a flood of incoming messages to the target system, essentially forcing it to shut down.
How do we control who can see and modify data? The most common approach is based on the trio of:
From Wikipedia
Authentication is the act of verifying a claim of identity.
From Wikipedia
When John Doe goes into a bank to make a withdrawal, he tells the bank teller he is John Doe, a claim of identity. The bank teller asks to see a photo ID, so he hands the teller his driver’s license. The bank teller checks the license to make sure it has John Doe printed on it and compares the photograph on the license against the person claiming to be John Doe. If the photo and name match the person, then the teller has authenticated that John Doe is who he claimed to be.
From Wikipedia
There are three different types of information that can be used for authentication:
For stronger authentication multiple pieces of authentication information can be use including those from multiple categories (know, have, are)
From Wikipedia
After a person, program or computer has successfully been identified and authenticated then it must be determined what informational resources they are permitted to access and what actions they will be allowed to perform (run, view, create, delete, or change). This is called authorization. Authorization to access information and other computing services begins with administrative policies and procedures.
We use logging and monitoring to determine:
Threats are any mechanism or technique that can intentionally or accidentally compromise the confidentiality, integrity or availability of a system.
“A primary aim of the OWASP Top 10 is to educate developers, designers, architects, managers, and organizations about the consequences of the most common and most important web application security weaknesses. The Top 10 provides basic techniques to protect against these high risk problem areas, and provides guidance on where to go from here.”
Almost any source of data can be an injection vector, environment variables, parameters, external and internal web services, and all types of users. Injection flaws occur when an attacker can send hostile data to an interpreter.
This is almost entirely a software development issue
From OWASP Broken Authentication
Attackers have access to hundreds of millions of valid username and password combinations for credential stuffing, default administrative account lists, automated brute force, and dictionary attack tools. Session management attacks are well understood, particularly in relation to unexpired session tokens.
From OWASP Broken Authentication
The prevalence of broken authentication is widespread due to the design and implementation of most identity and access controls. Session management is the bedrock of authentication and access controls, and is present in all stateful applications.