what is the the security functinality triangle? i couldn't find nothin of google that would explain this term.
Printable View
what is the the security functinality triangle? i couldn't find nothin of google that would explain this term.
God:
Found here from this Google searchQuote:
The easiest way to imagine the extent of functionality is a triangle with Functionality, Ease of Use and Security at the 3 corners. If there is too much functionality, there will be nominal security and it would be very hard to use for the average person. Alternatively, if it is too easy there will be almost no security or functionality. Finding the optimal point on the triangle is the hardest part of this step and involves taking into account the average computer literacy of the organizations user base.
Hope this helps.....
sorry i did not put the & i thought that google put it by default
Quod
You may not understand Boolean parameters.......................try putting things in parentheses (inverted commas) like "this"................it will string all words together?
Cheers
what are the sides of the triangle??
i am currently reading a google tutorial
Quod
FINISH reading, then ask...........also learn grammar and spelling:
FUNCTIONALITY has an "o" in it huh?..............Google is for people who have some intelligence?.............it assumes that you spell the words correctly?
Just a little advice
Cheers
you don't need the &. Actually, google drops them when you do the search...
without the & it is the 4th link that I got on google.
Soul: Then why was it the first with my "&"'s?
The first search I did didn't look as good but it is the one you are talking about. I only scan the first 2 or 3 results to see if they are getting close... My &'s put what I wanted at the top so Google doesn't drop them..... It means I _insist_ that _all_ words are in the result as opposed to the site with the most of _some_ of the words are in the result.... It's a big difference..... Though not really in this case...
Looks like this is turning into a "how to use google" thread, which is a shame, because the original question is a good one.
The security functionality triangle/triad is an interesting concept, but it has never really caught on at higher levels. the reason for this is that iccomplete, difficult to quantify, and is frequently misapplied.
Incomplete because it fails to include "time" and or "cost", which I'll touch on in a moment.
Difficult to quantify... "what makes this easy to use? is it eaiser or harder now?" Though functionality and security are possible to accurately quantify.
The idea of security/usability/functionality all making up finite, mutually exclusive fails to apply to computer systems. (why it is most frequently applied) Computer security can be absolute the only road block is system cost. It is possible for formally verify every single state a system can ever exist in and ensure each state to be secure, with no regard for functionality/usability, though these things make the system more complex so the cost goes up, typcally way up. In physical environments (like banks for example) this model is more applicable, but still here it lacks the key component "time." If you have F functions that a banker can do and each function takes T time with a level of S security for example... and you desire to make the system more usable you have a few options:
If you wish to keep T constant and you add more fluff (extra steps is typically how you get greater easy of use) to ease usage: U , F and S must decrease. However you can also keep T constant and decrease either F or S at a rate of inverselt proportional to its counterpart.
But what if we can work with T? Now lets add more U and keep F the same... if we add more time this is possible and we can even keep S the same, with added checkpoints for the increase in U by adding still more time.
In short this is a good thorey to know, but I wouldn't base any work on it.
catch
so it is a triangle model that basicaly says that you could sacifice security usability/functionality and increase security for less usability/functionality. and the reason it is not refered to as often is because it lackes the valiable of time.
catch thank for the info although you lost me on the last 2 paragraph when you talk about banks, and time. could you please explain it in different words, and if i already have it on my first sentance , then thank you.
You more or less understand. :)
It is a flawed an infrequently refered to theroy so I wouldn't waste the time on learning it much more exactly than you already do.
catch
thanks catch
Y not look at a 3-d model instead of a triangle....... u will have a new dimetion to work with.....so u will have place for time as for the costes u must work on a 4-D image.... let time be the 4-th dimention as in the real world....//but it will make it incomperehasicble... for most ppl....
but if we stay in a 3-d model we can try to make a tetrahedron... then I think ther we will have 4-corners... for the 4 values...
Ok three things... a 4-d image? So you will do this with a collection of pyramids floating down a timeline? Um... wow.
The second thing is that the points are not all quantifiable and this leads to a lack of direct relationships between the points.
Lastly, computer systems can work in finite, perfectable modules which means that you can have all three points maxed out or bottomed out so the relationships are lost, completely defeating the concept on the model.
catch
catch i did some research and found out this
now which one is right??? :confused:Quote:
The "Security Functionality Triangle", or the CIA Triad as it is more commonly referred to are the three principles, or goals, of Information Security, namely:
Confidentiality
Integrity
Availability.
If any of these elements are disrupted, it has an impact on the overall security of an object.
Eachof the elements has differect threats to them, eg.
Confidentiality:
- cracking passwords
- disclosure of sensitive information
Integrity
- Spoofing attacks
- Man-in-the-middle Attacks
- Session Hi-jacking
Availability
- DoS / DDoS Attacks
Hope it helps.
If you have any other questions, feel free to ask.
Kind Regards
Sebastiaan Rothman
[email protected]
I have always seen that refered to as:
"The CIA Triad"
"The three security fundemantals"
"The three tenets of InfoSec"
These deal more with concepts then the level of functionality, I can see how it would be confusing though. On the CISSP the CIA triad will be refered to as such and not the "security functionality triangle"
The inverse of the CIA triad is the DAD (Disclosure, Alteration, Destruction) triad.
catch
I use yahoo it corrects all the time :D
ok thanks for clearing that up.