Page 14 - PowerPoint Presentation

This is the principle that objects are not disclosed to unauthorized subjects.
Security mechanisms that offer confidentiality offer a high level of assurance that
data, objects, or resources are not exposed to unauthorized subjects. If a threat
exists against confidentiality, there is the possibility that unauthorized disclosure
could take place.

2. Integrity

This is the principle that objects retain their veracity and are intentionally
modified by only authorized subjects. Security mechanisms that offer integrity offer
a high level of assurance that the data, objects, and resources are unaltered from
their original protected state. This includes alterations occurring while the object is
in storage, in transit, or in process. Maintaining integrity means the object itself is
not altered and the operating system and programming entities that manage and
manipulate the object are not compromised.

3. Availability

This is the principle that authorized subjects are granted timely and
uninterrupted access to objects. Security mechanisms that offer availability offer a
high level of assurance that the data, objects, and resources are accessible to
authorized subjects. Availability includes efficient uninterrupted access to objects
and prevention of denial-of-service attacks. It also implies that the supporting
infrastructure is functional and allows authorized users to gain authorized access.

Other security-related concepts and principles that should be considered and
addressed when designing a security policy and deploying a security solution are privacy,
identification, authentication, authorization, accountability, nonrepudiation, and auditing.

1. Identification
This refers to the process of claiming to be an identity when attempting to access
a secured area or system.
2. Authentication
This is the security process proving that you are that identity.
3. Authorization
This is the process of defining the permissions (i.e., allow/grant and/or deny) of a
resource and object access for a specific identity.
4. Auditing
This refers to the recording a log of the events and activities related to the system
and subjects.
5. Accountability
This is the process of reviewing log files to check for compliance and violations to
hold subjects accountable for their actions

ITEC106 – Systems Security Mr. John Mark L. Dula