Confidentiality, Integrity, Authenticity

CIA—confidentiality, integrity, availability—is the core foundation of information security. Anyone who has taken an introductory class in network security or operating systems (or a cyberspace survey course) knows these principles.

Cybersecurity professionals are taught to uphold and protect CIA, yet most of history’s high-profile cyber incidents succeed when they target and compromise one of these three points: confidentiality. Incidents from Target to Equifax to the Office of Personnel Management to Facebook have all represented some breach of confidentiality, in which information that was supposed to be protected was improperly disclosed. How breaches of confidentiality usually occur also implicate the ‘A,’ availability, when hackers deny access to information for legitimate users.

The Stuxnet cyber weapon, launched against an Iranian nuclear enrichment facility in Natanz, manipulated system data to hide the attack from plant operators. In addition to disabling alarms, the code transmitted false data to make it look like the plant was operating normally. (It wasn’t: the cyber weapon was spinning the facility’s centrifuges faster than they should have been, which ultimately damaged the devices and delayed Iran’s nuclear development program.)

Going forward, we’re going to see an increase in such attacks against data itself—attacks that compromise integrity. I might see a fraudulent charge on my debit card, or a company may suddenly find alterations in their ledgers. An intelligence agency may find out their phone interceptions were under manipulation, or a prosecutor may no longer be able to reliably present phone call records in a courtroom.

As critical infrastructure becomes increasingly connected—from hospital networks to traffic grids to server farms—attacks that manipulate data itself will become increasingly viable for malicious actors looking to disrupt any number of systems. We must ask ourselves: What happens when intelligence agencies cannot trust the integrity of their intel from the field? What happens when banks cannot trust the integrity of a transaction? What happens when live feeds from an electrical grid sensor are undependable? And so on.

Stuxnet was a complex cyber weapon that required time, resources, and sophisticated engineering. Not only did Stuxnet’s designers need inner knowledge of the Natanz plant’s operation, but they also needed expertise with its specific industrial control systems.

Point being, it won’t be easy for just anyone to manipulate data without a trace, especially in some of the sensitive and highly controlled environments mentioned above. But attacks that compromise the integrity of data are going to pose a greater risk over time, particularly when they originate from Advanced Persistent Threats or sophisticated cyber actors with the means and resources to execute such attacks precisely and in secret. The response, therefore, cannot just be to apply log management, user access control, and some of the more typical software (or hardware) cybersecurity solutions. More is needed to assure the provenance of data and to confirm its integrity.

In a world where data cannot be trusted, we need to start thinking about—and in some ways, rethinking—how we achieve trust in the digital records of our lives. For some, it may already be too late.

Justin Sherman is studying computer science and political science at Duke University. Justin researches federal cyber policy and digital strategy with the Laboratory for Analytic Sciences, an industry-intelligence-academia group focused on cyber and national security. The views expressed here are his own.