Re: Thou shalt have no other gods before the ANSI C standard

From: David Wagner (daw_at_taverner.cs.berkeley.edu)
Date: 02/24/05 

Date: Thu, 24 Feb 2005 20:54:09 +0000 (UTC)

Morten Reistad wrote:
>David Wagner <daw-usenet@taverner.cs.berkeley.edu> wrote:
>>JMFBAH wrote:
>>>Keeping a system up is the first rule of security.
>>
>>Not necessarily. It depends on the system.
>
>This was not what I learned in the Navy. There is a golden rule
>in all military service that no functional computer data is
>surrendered to the enemy. Firing grenades inside the disk drives
>was sometimes deemed sufficient, other times thermite fires inside
>CPU cabinets was needed. This is analyzed in detail for avery system
>used, and procedures laid out. The grunts then get to exercise the
>hardware version of "rm -rf *" until they get down to seconds.

A great example of a system where confidentiality is more important
than availability. The key is to understand your goals and to think
carefully about how to prioritize them, so that when it comes time to
make tradeoffs, you can make those tradeoffs intelligently.

>There are times when the best service is no service. Such as when
>the person doing identity theft on a significant fraction of the
>village's population is down at the ATM trying to empty out accounts.
>Nixing the ATM service suddenly seems like a very attractive solution.

Yes. A good example of a system where integrity is more important
than availability. Again, which goal is more important will depend
on the application (and on the threat environment, etc.) -- you've got
to do the analysis.

There is no one answer that is right for all systems. In some systems,
availability may well be more important than perfect integrity or
confidentiality; in others, integrity or confidentiality may be more
important than availability; and so on.

Relevant Pages

  • Re: Patching
    ... > availability, confidentiality and integrity, isn't it? ... > system availability to name a few instances). ... > from a security perspective. ...
    (Security-Basics)
  • RE: New security Triad
    ... Confidentiality, Integrity, and Availability are the crown jewels that we ... Subject: New security Triad ...
    (Security-Basics)
  • RE: Why NOT to disable Real Time Antivirus on Servers
    ... <snip Security professionals often end up only thinking in terms of ... PL] You mean they ignore the availability aspect from ... a part of security as confidentiality and integrity. ...
    (Security-Basics)
  • Full post
    ... These systems are not designed to provide security for long term storage over decades. ... Dispersal allows the user to achieve high levels of confidentiality and availability while minimizing storage inefficiency. ... If the hard drive, CD-ROM, thumb drive or whatever media storing the key is lost, breaks or becomes corrupted then the encrypted data will remain forever irretrievable. ...
    (alt.computer.security)
  • Re: Patching
    ... Security is availability, ... confidentiality and integrity, isn't it? ... to behave incorrectly from a security perspective. ... revision X.x with applications Y.y and disk/tape drivers at revision Z.z. ...
    (Security-Basics)
Quantcast