The attacks in 0004.a are varied, but what they damage can be described in only three ways, and those three goals give a way to organize the defenses. This section starts with the goals, then sorts safeguards into three kinds by what they act on: physical things, digital systems, and human behavior. It then looks at groups of safeguards that serve particular purposes, first controlling who can get in, then making sure data survives when something goes wrong, then detecting whether data has been changed. It ends with a small, familiar case, a home router, where several of these ideas meet.

What safeguards protect#

The CIA triad names the three properties security tries to preserve. Confidentiality means that only authorized people can read data. Integrity means that data aren't improperly altered, so a stored record can be trusted as correct. Availability means that data and systems are usable when they are needed. Classifying a harm by these three makes the right response easier to see. A breach in which outsiders read student records is a loss of confidentiality. A student who changes a grade in the gradebook has violated integrity, even if nobody else ever reads it, while merely viewing the grade would have violated confidentiality. A server outage that keeps teachers from entering attendance, with nothing read or changed, is a loss of availability, the same property a denial-of-service attack targets. Safeguards often favor one property over another. Redundancy, such as a second server, serves availability. Keeping grades on a computer that is never connected to a network gives outsiders fewer chances to read them, which helps confidentiality, but it also gives teachers fewer hours in which they can use them, which costs availability. That kind of trade-off is the subject of 0004.c.

Three kinds of safeguard#

Safeguards can be sorted by what they act on. Many security frameworks call these physical, technical, and administrative controls, where administrative controls are the policies, procedures, and training that shape what people do. This guide uses the names physical, digital, and behavioral.

Physical safeguards prevent direct access to hardware. They include locked rooms with controlled access for servers and network equipment, access badge readers at doors, cameras that discourage unauthorized entry and record who enters, and securing devices themselves, such as locking a laptop cart and keeping it in a secured room. Physical access can bypass many digital defenses, since someone who can plug into a network port or walk off with a device doesn't need to break a password, so physical safeguards also include disabling unused network ports and supervising visitors in the building. Login screens and network controls do nothing against a thief carrying away a cart of laptops, which is why securing the devices addresses theft directly.

Digital safeguards are built into hardware and software. They include encryption (the subject of 0004.d); firewalls, which allow or block traffic between networks according to set rules; access controls, which decide which accounts can use which resources; intrusion detection systems, which monitor for suspicious activity and raise alerts; antivirus software, which recognizes known malware; and regular patches, which close known vulnerabilities. Each has limits. Antivirus software can miss new or customized malware that doesn't match anything it recognizes, and a patch helps only if it is applied, so a breach through a flaw whose fix was available but never installed is a lapse in patching. Because any one safeguard can fail, organizations use several layers, so that one failure doesn't expose everything. This approach is called defense in depth, and it is the reason a firewall, antivirus software, and staff training are complements rather than alternatives.

Behavioral safeguards are practices and training that shape what people do. They include recognizing phishing, verifying unusual requests through a second channel, such as calling a vendor at a number already on file before changing its bank details, and locking the screen each time a computer is left unattended, which stops others from using an open session. Simulated phishing messages give staff practice at spotting scams before a real one arrives, teaching them what real attempts look like. How training is delivered matters: short, frequent exercises that give feedback on realistic situations are more effective than a long video watched once a year. Behavioral safeguards also work better when the secure action is also the easy one. Asking staff to type a long password every time they return to a workstation invites them to leave it unlocked, while pairing a quick badge login with automatic locking of idle workstations makes locking painless.

Controlling who gets in#

Many of the attacks in 0004.a end with someone using an account they shouldn't, so a central group of safeguards controls authentication, proving who someone is, and authorization, deciding what they can do. These safeguards cut across the three kinds above, since each combines a technology with a habit or a policy.

Multifactor authentication (MFA) requires two or more different types of factor: something you know, such as a password; something you have, such as a phone or security key; and something you are, such as a fingerprint. A password followed by a code from an app on the user's phone combines something known with something possessed. The factors must be of different types, so a password and a security question, or two passwords, are both things the user knows and count as one type. MFA mitigates attacks that use stolen passwords, because the password alone is no longer enough. It isn't complete protection, though: a fake login site can forward each code to the real site as the user types it. Where MFA can't be applied everywhere at once, administrator accounts and accounts used for remote access should come first, because compromising them would cause the most damage.

Passwords remain the first factor almost everywhere, and the attacks on them in 0004.a show what makes one strong. Long, random, unique passwords resist guessing and stop a single breach from unlocking other accounts. Length matters more than complexity, because each added random character multiplies the possibilities, while predictable substitutions such as @ for a are already tried by attackers' tools. A passphrase of several unrelated, randomly chosen words is long and still memorable, and personal details such as a birthday are poor choices because they are predictable. Nobody can remember a different long password for each site, which is what a password manager solves, by storing them all behind one master password. The manager's master password then needs strong protection of its own, but one site's breach no longer unlocks other accounts. If a password does leak, it must be replaced everywhere it was used, with a different new password for each site.

Authentication establishes who someone is, and the principle of least privilege governs what they may then do: give users only the access their role requires. A clerk who enters invoices needs only the permissions that entering invoices requires, and a web application's database account should hold only the rights the application actually uses, such as read access on one table, so that an attacker who compromises the application is limited to what that account can do. Excess privilege increases the damage a compromised account can do, since an attacker who takes over a technician's account gains everything that account can reach. File and folder sharing follows the same principle and should be limited to the individuals and groups who need access. An "unlisted" link isn't access control, because anyone who obtains the link can open the folder and no person is identified. Access also tends to grow over time, as people change roles and keep their old permissions while gaining new ones. This privilege creep calls for regular reviews of who has access to what.

Keeping data available and recoverable#

The next group of safeguards assumes that something will eventually go wrong, whether a failed disk, a deleted file, or ransomware, and makes sure the data survives. Backups protect both integrity and availability, because a clean copy can replace data that was altered or lost. The 3-2-1 rule calls for three copies of data, on two types of media, with one off site, for example the original, a copy on an external drive, and a copy at a separate location. The off-site copy protects against local disasters such as fire or flood. A backup that has never been restored is an assumption, so organizations should regularly test restoration to show that their backups can actually be used. Not every copy is a backup in this sense. Syncing or mirroring copies every change immediately, including an accidental deletion or an overwritten file, while version history keeps earlier copies so that a mistaken change can be undone.

Backups restore data after an outage, while redundancy prevents the outage. Redundant servers keep a service available if one fails, as when a second server continues the service when the first one goes down.

At the far end of protection is the air gap. An air-gapped computer has no physical or wireless connection to outside networks, which may mean that its network and wireless hardware has been removed. This eliminates remote access, but it doesn't stop threats carried in physically: the machine remains vulnerable to people with physical access and to removable media such as USB drives. Any connection, even a temporary one, creates a network path and removes the guarantee that remote access has been eliminated. The cost is convenience, since moving data and applying patches have to be done through careful manual procedures. That cost is justified only when the stakes are very high, as with the control system for a nuclear power plant, and not for systems that exist to be reached over a network, such as a gradebook.

Detecting changes with hashes#

Backups help restore integrity, and hashes help detect when it has been lost. A cryptographic hash function turns any data into a short, fixed-length value that works as a one-way fingerprint of the data. It isn't encryption, since there is no key and nothing to decrypt, and it isn't compression, since the original can't be recovered from it. Changing even one character of the input produces a completely different hash, so comparing the hash of a downloaded file with the value its publisher posted reveals whether the file has been altered. Recording each important file's hash and comparing it on a regular schedule reveals changes to the files over time. A matching hash shows only that the file matches the published value, though. If an attacker has compromised the server that hosts both the file and its posted hash, the attacker can replace both, and the match proves little. Hashes also have a second use, storing passwords, which 0004.d describes.

A small case: securing a home router#

A home router, or the one in a small classroom or office, gathers several of these ideas into a short procedure. First, change the default administrator password, because default credentials are published and the administrator login controls the router's configuration. Second, use current encryption for the wireless network, such as WPA3, since the older WEP and the original WPA are weak. Third, disable unneeded remote administration, which closes a route by which outsiders could reach the router's settings; turning off unneeded features in general reduces the ways an attacker can get in. Fourth, update the router's firmware, which is how its own flaws are corrected. One common step doesn't help much: hiding the network's name is obscurity, not protection, because tools can still detect the network, so current encryption and strong passwords matter more. Each of these safeguards costs something, if only time, and 0004.c turns to how organizations weigh those costs.

• CIA triad: confidentiality, integrity, and availability
• confidentiality: only authorized people can read data
• integrity: data aren't improperly altered
• availability: data and systems are usable when needed
• physical safeguards: protections that prevent direct access to hardware, such as locks, badges, and cameras
• digital safeguards: protections built into hardware and software, such as encryption, firewalls, and patches
• behavioral safeguards: practices and training, such as verifying requests and locking screens
• firewall: a device or program that allows or blocks traffic between networks according to set rules
• intrusion detection: monitoring for suspicious activity and raising alerts
• defense in depth: using layers of safeguards so that one failure doesn't expose everything
• multifactor authentication (MFA): requiring two or more types of factor, from something you know, have, and are
• password manager: software that stores many unique passwords behind one master password
• principle of least privilege: giving users only the access their role requires
• privilege creep: the accumulation of access over role changes
• 3-2-1 rule: three copies, on two types of media, with one off site
• version history: earlier copies of a file kept so that changes can be undone
• redundancy: duplicate systems that keep a service running if one fails
• air gap: no physical or wireless connection to outside networks
• cryptographic hash: a one-way fingerprint of data, used to detect alteration
• WPA3: current encryption for wireless networks

Practice: practice questions for 0004.b