Failure to provide secure and reliable access to data can have dire repercussions for any organization running online operations. With the European Union’s complete overhaul of its General Data Protection Regulations (GDPR) going into effect in May, the whole cybersecurity question takes new dimensions. But how do you evaluate the integrity and security of your data store?

The CIA Triad is the most popular reference model for Information Security and Information Assurance that stands for Confidentiality, Integrity, and Availability. Sometimes affectionately referred to as the Holy Trinity of Data Security, the CIA Triad is also called the AIC triad (Availability, Integrity, Confidentiality) by some InfoSec experts who want to avoid confusion with some well-known three-letter agency.

In this model, confidentiality stands for a set of directives that prevent the exposure of data to unauthorized parties by governing and limiting access to it. Integrity describes the rules that preserve the trustworthiness and healthiness of data and prevent unauthorized users from tampering with it. And availability promotes a state where authorized people are guaranteed to have reliable access to the information.

Confidentiality

In the general context, confidentiality is all about preventing the disclosure of data to unauthorized parties. But in rigorous terms, it also tries to keep the identity of authorized parties involved in sharing and holding data private and anonymous. Keeping the involved parties’ identity confidential contributes to the overall CIA triad. Without being able to reliably identify and pick their targets, attackers have to randomly target participants in the network. This in effect increases the costs to compromise the system and adds to its overall security.

Standard measures taken to establish confidentiality include but are not limited to encryption, passwords, two-factor authentication, biometric verification, security tokens, and more.

Some of the challenges that could compromise confidentiality are as follows:

• Encryption cracking
• Man-in-the-middle attacks on plaintext data
• Insider leaks where the data is not end-to-end encrypted
• Doxxing private information of data holders

Yobicash manages and ensures confidentiality by using an end-to-end encryption based on the Elliptic Curve Integrated Encryption Scheme (ECIES). This system of encryption is resilient to anything short of quantum attacks, which are still ten to twenty years away from now. Yobicash credentials are anonymous and untraceable, so the involved parties know just what is needed for a one-time data transfer. Public key reuse is also forbidden and enforced by using anonymous credentials. Furthermore, the use of public key cryptography eliminates the need to rely on insecure channels of communication to build shared keys.

Integrity

Integrity preserves the authenticity of data over its whole life cycle by making sure unauthorized parties are not able to tamper with it. It also ensures that data is not corrupted due to unintentional software or hardware malfunction.

Standard measures to guarantee integrity include access controls, cryptographic checksums, uninterrupted power supplies, and backups.

Following are some of the challenges that could endanger integrity:

• Tampering plaintext data on the fly in a man-in-the-middle attack
• Compromising a cloud server where end-to-end-encryption is not used
• Dropping or rerouting packets on the fly in a man-in-the-middle attack

Yobicash uses mathematically calculated numbers, called checksums, to verify whether transactions have been illegitimately modified after their creation. In addition, authenticated encryption provides for reliable integrity checks of encrypted data. In this model, the encryption scheme is securely and reliably combined with a message authentication code (MAC) that guarantees the authenticity of the message and its sender. The authenticated encryption model ensures confidentiality and integrity at the same time. Furthermore, since Yobicash stores data on a distributed ledger, nodes and clients can always retrieve integer versions (checksums) of the altered transactions from other nodes and clients to compare them and ensure their integrity. It is worthy to note that the consensus algorithm between the nodes in Yobicash would eventually trigger this check anyways, as the network participants start to negotiate and settle on the new state of the distributed ledger.

For an attacker to undermine the integrity of Yobicash data, it has to launch a man-in-the-middle attack on roughly two-third of the network connections, which requires dropping or altering their packets. The entrance barrier for such is so high and the necessary resources so hard to assemble that organizing it would be of no economic value. But as the network grows and matures, even this strategy would become an endeavor of unrealistic proportions.

Availability

Availability of information promotes the state where authorized parties are able to access the information whenever needed.

Information unavailability can occur due to security incidents such as DDoS attacks or hardware/software malfunctions or insufficiency of bandwidth or other hardware or software resources. Some standard measures to guarantee availability include failover, redundancy, RAID and high availability clusters, adequate communication bandwidths, firewalls and proxy servers, and comprehensive disaster recovery plans.

Some of the challenges that could endanger availability on centralized architectures are as follows:

• DDoS (Distributed Denial of Service attacks) on servers preventing authorized parties from accessing the service
• Ransomware attacks encrypting data on servers preventing authorized parties from viewing the data
• Disrupting the data center’s power supply

Yobicash runs on a decentralized and anonymous network of nodes with full replication. This architectures removes the single points of failure present in centralized systems and creates a high barrier for conventional availability attacks like DDoS, ransomware and power outages. As shown in the whitepaper, the upfront resources necessary for such a successful attack are economically unfeasible.

Conclusions

With the internet becoming ubiquitous in our everyday lives, data security plays an increasingly vital role.

Since every open network is subject to externalities, the security of services is interdependent. Unfortunately, market dynamics disincentivize network participants from investing in their security, as the costs of investing in a network resource are way higher than its marginal benefits. Consumers generally tend to buy services at the lower end price range without realizing that in the long run, they will pay more due to security breaches.

Yobicash aims to put an end to this dilemma by changing the landscape of information storage and sharing economy. By design, Yobicash’s intentionally simple architecture reduces its attack surface. Furthermore, Yobicash’s fee and mining system incentivize network participants to invest in their security upfront, while increasing the costs for failing to do so.

While the whole CIA triad must be rigorously implemented to provide for a network’s information security and information assurance needs, when the time comes to implement the model, real world limitations force every service to give more weight to one or another of the three pillars.

To secure proprietary assets like software, confidentiality is key, while integrity has more importance when securing banking data. On the other hand, publicly accessible data like websites need to provide for availability above all else.

Yobicash’s data storage and sharing model relieves nodes and clients from the dilemma of giving more importance to one or another of the three pillars. By design, Yobicash puts most of the burden of information security on itself while incentivizing nodes and clients to harden up their individual security.

—

Yobicash: the next generation of data storage.

Revolutionize the way you store and send data. Yobicash empowers you to take charge of your data security with cloud storage & transfers that are always private, encrypted and available.

Incentivised by a cryptocurrency, built on DAG chain technology.

👉 For more information about Yobicash & to chat directly to the team, join our community.