Previously, we’ve introduced the CIA Triad and the components of its acronym: Confidentiality, Integrity, and Availability. We’ve already covered Confidentiality and Integrity, this time we’re going to cover Availability.
In the trinity of information security principles, known as the CIA Triad, ‘Availability’ is the leg that is most often easily attacked by “script kiddies” or ruined by our own success. Today, let’s unravel what Availability means in information security, its real-world significance, and the fallout when it’s compromised.
Understanding Availability
In the context of information security, Availability refers to ensuring that information and resources are accessible to authorized users when needed. It’s not just about having data; it’s about having data ready for use, unhindered by obstacles like system failures, cyberattacks, or natural disasters.
Ensuring Availability
- Redundant Systems
- These are backup systems that kick in when the primary system fails, ensuring continuous access to data. This would be very important if your system has a failure due to hardware failures. Do you have the ability for your active system to switch to another hot system, a warm system, or even a cold site? How quickly?
- Regular Maintenance and Updates
- Keeping systems updated and well-maintained to prevent downtime caused by software or hardware issues. Best way to stay out of trouble is to avoid trouble. You need to make sure you’re patched and your equipment is running well, as well as relying on things like SMART for hard drive health. This is also where knowing metrics like MTTF (Mean Time to Failure) are important. If you have components that are coming up on their expected shelf-life, you need to start mitigating now.
- Disaster Recovery Plans
- Preparing for the worst – from cyberattacks to natural disasters – to ensure rapid restoration of services. What do you do if something happens to an entire site? That can mean your local power grid if you’re self-hosting, or issues with cloud regions with the big providers (it happens… more than we’d like!). Just like with Redundant Systems, you should have Redundancy at both the micro and macro level for your system.
Real-World Examples
- E-Commerce Platforms
- Imagine an e-commerce site crashing on Black Friday. The lack of availability can lead to significant financial loss and customer dissatisfaction. All “scale-based” attacks don’t have to be Denial of Service (DOS) or Distributed Denial-of-Service (DDOS). Sometimes, you can DOS yourself by running a huge promotion or you can get squished by going viral on a site like Reddit.
- Healthcare Systems
- In healthcare, system availability can be a matter of life and death. If medical staff can’t access patient records promptly, patient care could be compromised. This is true at every leg of the chain. You don’t have to look too far into the past to remember the Healthcare.gov debacle where literally hundreds of millions of dollars were spent on a site that couldn’t stand up to everyone trying to sign up for “Obamacare”. You’d think those millions could buy you a few people who had worked at Facebook, Twitter, Reddit, Netflix, or somewhere where they might have had an idea how to ensure Availability through hard-learned lessons, but apparently not.
- Banking Services
- If an online banking platform is unavailable, customers cannot perform transactions, leading to frustration and potential financial complications. We just take this one for granted because banks have gotten so good at this, but imagine if you went to the store and tried to use your card and your bank (and just your bank) wasn’t playing ball today. I’ve been in stores where the “Credit Card Machine” was down, but I can’t think of one time that I couldn’t use my banking features due to my bank having an issue. I’m not saying it never happens, but this might just be the rarest version of this because they take Availability very seriously.
The Consequences of Poor Availability
When systems aren’t available, the consequences can be dire. We covered that a little bit with the real world examples, but here are some consequences boiled down:
- Loss of Revenue
- For businesses, downtime often translates directly into lost revenue, especially for services that depend on continuous online presence.
- Damaged Reputation
- Customers expect reliability. Frequent downtimes can tarnish an organization’s reputation and erode trust.
- Operational Disruption
- In sectors like manufacturing or logistics, lack of availability in information systems can lead to halted production lines or disrupted supply chains.
Protecting Against Availability Threats
To safeguard against threats to availability, organizations should:
- Invest in Robust Infrastructure
- This includes not only having backup systems but also ensuring that the infrastructure can handle high loads and resist cyberattacks. This one can be expensive, so a lot of people short change it at the beginning of their journey. “I can barely afford one server, how can I afford to pay for a second one I may never need?” I get it… but accepting a risk doesn’t make it go away. This is one that you’ll want to mitigate as soon as possible.
- Implement Effective Monitoring Systems
- These systems can alert administrators to potential issues before they cause downtime. Have you ever wondered what people are doing in Network Operations Centers (NOCs) and Security Operations Centers (SOCs)? This.. they are doing this. They are keeping their fingers on the pulses of all of the logs and metrics behind the systems, hoping to find signs of intrusions and failures and prevent them or respond as soon as possible.
- Regularly Test Recovery Procedures
- Regular testing ensures that, in the event of a system failure, the recovery processes are effective and efficient. Netflix has their Chaos Monkey code that just randomly shuts stuff off to ensure they can handle that happening regularly. They were the first company I heard of doing such a thing. They’ve since open-sourced it to share with others to potentially make everyone stronger. According to them, “Chaos Monkey randomly terminates virtual machine instances and containers that run inside of your production environment. Exposing engineers to failures more frequently incentivizes them to build resilient services.” Yep.
Conclusion
The ‘A’ in the CIA Triad – Availability – is a crucial component of information security. In our interconnected world, where we depend on instant access to information, ensuring that this information is readily available is as important as keeping it secure and intact. Knowing how to keep your systems running in the face of all that the world has to throw at you is vitally important and something you need to consider with your technology decisions.
