Cybersecurity guide for developing countries
Data integrity can only be guaranteed if data are protected from active tapping techniques that can be
used to modify the intercepted information. This type of protection can be provided with such security
mechanisms such as
–
strictly enforced access control;
–
data encryption;
–
protection against viruses, worms and Trojan horses.
Figure I.8 – Cybersecurity basics
The system must…
...be capable of being used
...operate correctly
...provide access for
authorized entities (while
denying unauthorized
access)
...verify actions
Security objectives
Security tools
•
•
•
•
•
•
•
•
•
availability
sustainability
continuity
confidence
operating security
reliability
durability
continuity
correctness
•
•
•
dimensioning
redundancy
operation and back-up
procedures
•
•
confidentiality (secrecy)
integrity (no changes)
•
•
non-repudiation
authenticity (beyond
doubt)
non-contestation
•
•
•
•
•
•
•
•
•
•
•
•
•
•
design
performance
ergonomics
quality of service
operational maintenance
access control
authentication
error control
consistency check
encryption
certification
logging, traceability
electronic signature
proof mechanisms
•
I.2.10.3
Confidentiality
Confidentiality is the safeguarding of secrecy of information, information flows, transactions, services
or actions performed in cyberspace. It guarantees the protection of resources against unauthorized
disclosure.
Confidentiality can be implemented by means of access control and encryption.
Encryption helps to protect the confidentiality of information during transmission or storage, by
turning it into a form that is unintelligible to anyone who does not possess the means to decrypt it.
I.2.10.4
Identification and authentication
The purpose of authentication is to remove any uncertainty about the identity of a resource. It
presupposes that all entities (hardware, software and persons) are correctly identified and that certain
characteristics can serve as proof of identification for them. In particular, logic-based access control
systems to IT resources require that the identification and authentication of entities be managed.
22
Cybersecurity