Computer security and data protection are among the basic areas that anyone who works with information online should understand. They focus on protecting data and information against unauthorised access, loss or misuse. Key principles such as confidentiality, integrity and availability of data form the basis of the so-called security triad, which helps prevent cyber threats and protect sensitive information. In this article, we look at what these principles mean in practice and how to apply them effectively.

Basic principles of data and information protection

Cybersecurity deals with protecting data and information that reside primarily in virtual space. In practice, these are data and information stored, for example, on various remote or company servers, computers, data centres, the internet or mobile devices.

The security triad in computer security and data protection consists of three key principles that everyone should know – not only IT professionals, but ordinary users too:

Confidentiality

Whenever you process any data or information, you should always respect the principle of confidentiality. This rule says that every piece of data and information we come into contact with should be provided, shared and disseminated only to designated, authorised persons. Every piece of confidential information carries a potential risk of misuse in personal and/or professional life, so it is crucial to protect these data and information from those who could misuse them.

Confidential information means any non-public information whose disclosure or release could harm an individual and/or an organisation.

Integrity

The integrity of data and information represents the concept of completeness and correctness of data and information. In practice, ensuring data integrity involves measures that aim to ensure that this information is not modified, misused or deleted throughout its entire life cycle.

Data integrity is the accuracy, completeness, consistency and reliability of data from their creation to their deletion.

Availability

Availability of consistent data and information means that they are available to authorised persons in full and whenever they need them. It also indicates that this information is protected against misuse by unauthorised persons and/or entities.

These three principles form the foundation of every security strategy. If even one of them is violated in practice, the data protection system is normally not considered secure. All three areas are closely interconnected and support one another.

The general principles of personal data protection under Act No. 18/2018 on the Protection of Personal Data also apply in cybersecurity, for example:

• Lawfulness of personal data processing.
• Purpose limitation for which the data are processed.
• Minimisation and accuracy of the processed data.
• Limiting the retention period of the processed data.
• Restrictions on providing and disseminating the processed data.
• Principles, rights and obligations in line with applicable Slovak and European personal data protection legislation.

Practical application of the basic data protection principles

Computer security and data protection should be an everyday part of company processes, not just a theoretical concept. You can also uphold the principles of the security triad in practice through the following practical measures.

Confidentiality in practice

The main goal of this principle is to ensure that data and information are available only to authorised persons. Confidentiality is a key aspect especially for data classed as personal, banking, health, strategic, corporate and similar information.

You can ensure the security of data and information in several ways:

• Data encryption.
• Granting access rights.
• Multi-factor authentication.
• Biometric authentication.
• Segregating sensitive data.
• Restricting physical access.

Integrity in practice

The basic purpose of the integrity principle is to ensure that data remain complete, accurate and unchanged throughout their existence.

You can ensure the security of data and information, for example, through:

• Digital and electronic signatures.
• Audit logs.
• Automated monitoring of file changes.

Availability in practice

The basic goal of this protective principle is to ensure that authorised persons always have access to the data they need.

You can ensure the security of data and information through:

• Regular checks and backups of data and information.
• Protection against DDoS and ransomware attacks.
• Using redundant systems and servers.
• Using the cloud.
• Using independent power sources.
• Availability monitoring.

Summary

The security triad is the foundation of every security policy. Every IT measure designed to protect data and information should therefore include all three security principles above, and these principles should be set in balance with one another. Too much confidentiality can reduce data availability, and vice versa. When analysing incidents, it is then important to determine which part of the triad was affected and to take the necessary measures to restore or strengthen it.

This article is an output of the project “Multitenant Cybersecurity Operations Center Delivered as an Open Cloud Service with Machine Learning Elements.” Project code – 09I05-03-V02-00010.