Original subtitles

Welcome to the practice activity related to CAA Triad.

So in this practice activity, I'm going to share with you a couple of situations and then I'm going

to ask you to identify if you can correctly detect which pillar of CIA has been violated.

It's going to allow you to apply some of the knowledge that you've learned in the previous lecture.

So let's begin.

So let's say you work as a cloud engineer in your enterprise, and your job is basically to maintain

and access the data stored on the cloud for your company.

Right.

So one fine morning, you walk into your office and you want to log in to your system in order to access

the data of your company, which resides on the cloud.

And when you do the log in, you see this error message that your account has been locked due to multiple

failed attempts to log in.

Now, clearly, someone tried to access your account to give the password maybe a couple of times,

and as a security measure, the cloud company has locked your account.

Now, which pillar of CIA has been violated in this instance?

Is it confidentiality?

Is it integrity or is it a availability?

I'm going to wait for a few seconds.

And in the meantime, you can try to come up with the solution.

So in this particular situation, the pillar that has been violated is actually availability.

See, the point is that since your account is locked and imagine if you really need access to some data

immediately, maybe, you know, a client has requested something or one of your applications needs,

you know, some of the data.

So at this point in time, you have an issue of availability of your data, right?

Obviously, you may be able to resolve it eventually by working with the Help Desk or maybe you have

a backup email in order to reset your password or, you know, it could be any other mechanism.

But at this point in time, it's a bit of, you know, problem of availability.

Now, your confidentiality and integrity has not been violated, or at least that you know of, because

you don't have any proof that someone actually gained access to your account.

A noteworthy indication is that two, basically they had failed attempts to they were not able to actually

log into your system.

So your confidentiality of your data as well as integrity of your data can be assumed to be, you know,

still intact.

So that was the first situation.

Let's see if you can solve the second one.

Now let's say you're working in your office and you know, you have to send out an email to some of

the employees in your organization.

And this email basically contains some confidential data or, you know, proprietary information of

your company.

So what you do is that you write your email and you send it to all these people.

But by accident, you also included someone from another organization.

And now they have also received a copy of that email.

Not in this situation, which pillar of CIA has been violated?

I'm going to wait a couple of seconds.

So the correct answer in this situation is confidentiality.

See confidentiality is when someone who's not authorized access to certain classified information gains

access to it.

Now, this doesn't matter whether that person is going to actually, you know, exploit that information

or not.

At this point in time, the confidentiality of your data has been compromised.

Okay, let's move on to the third situation.

So once again, assume that you work as a cloud engineer at your company and you manage the data hosted

on the cloud for your company.

Right.

So during the night, what happened was that an attacker was able to get write access to your database

and he was able to insert some malicious records or some malicious documents in your database.

He was not able to actually read any of the data, but he did get write access.

So he inserted some malicious records.

So in the morning when you come and you run your daily data verification checks, it sends you an alert

that there is some problem with the data.

So in this situation, which pillar of CIA has been violated?

Is it confidentiality, integrity or availability?

I'm going to wait a couple of seconds.

So the correct answer is integrity.

See, the confidentiality has not been compromised because, as I said, they were not able to get any

read access, so they were not able to actually read any of your data.

So they were not able to compromise the confidentiality.

They did get write access and they were able to insert some records in your database.

So now you cannot trust the data to be valid, right?

So the integrity of data has been violated.

And as regarding availability, there is no issue.

You have access to your data still, right?

So the right answer for this situation was integrity.

So I hope these practice activities have given you some tips and insights into to be able to discern,

you know, which pillar of CIA is violated in different situations.

Thank you.

And I'll see you in the next lecture.