97 Things Every Information Security Professional Should Know

Chapter 33. Availability Is a Security Concern Too

Jam Leomi

One thing I remind people of when looking at the three pillars of security, consisting of confidentiality, availability, and integrity (CIA): the one that holds the other two up is availability. As our industry continues its time of cloud-based infrastructure, applications, and SaaS-y services, security should keep in mind that uptime also equals things staying available and online, not just operations. It ensures that everybody at the company gets paid and that the business grows. So, as a security practitioner who should be holistically thinking about operations when architecting a program, one must consider all the different ways availability can be impacted in this current (and future) world we live in.

The first issue is ensuring that any security operational changes we make don’t impact the company. That’s ensured by, of course, collaborating with teams to ensure that changes made don’t have adverse impacts. At one place I worked, even after testing, rolling out firewall changes company-wide resulted in a hard downtime because none of the Ops team knew of the rollout, which resulted in a longer investigation and uncovering unknowns. While it was a learning experience, it definitely could have helped to give the team a forewarning that availability could be impacted or that the change should be monitored.

The second ...