What is Availability in Information Security?
Availability is part of the “CIA Triad” that represents Confidentiality, Integrity and Availability, which forms the foundational principles for securing information and systems. The CIA Triad concept is meant to balance these principles as a “three-legged stool” where all three legs are needed, or the stool topples over.
In 2017, ComplianceForge published the Confidentiality, Integrity, Availability & Safety (CIAS) replacement for the traditional Confidentiality, Integrity & Availability "CIA Triad" that served as the traditional function of cybersecurity. With embedded technologies (e.g., Internet of Things (IoT) and Operational Technology (OT)) and the rise of Artificial Intelligence (AI) and autonomous technologies (AAT), the lack of a safety component makes the CIA Triad insufficient to define the concept of what cybersecurity is meant to perform.
The security of systems, applications and services must include controls and safeguards to offset possible threats, as well as controls to ensure confidentiality, integrity, availability and safety:
- CONFIDENTIALITY – This addresses preserving authorized restrictions on access and disclosure to authorized users and services, including means for protecting personal privacy and proprietary information.
- INTEGRITY – This addresses protecting against improper modification or destruction, including ensuring non-repudiation and authenticity.
- AVAILABILITY – This addresses timely, reliable access to data, systems and services for authorized users, services and processes.
- SAFETY – This addresses reducing risk associated with technologies that could fail or be manipulated by nefarious actors to cause death, injury, illness, damage to or loss of equipment.
In the CIA triad, availability complements confidentiality and integrity. It ensures that services remain usable and effective without sacrificing performance or security. The concept of availability underpins business resilience and includes:
- System uptime. Measured by availability metrics like Mean Time Between Failures (MTBF).
- Data accessibility. Access for authorized users, even during failures or disasters.
- Continuity considerations. Availability over time, across planned (maintenance) and unplanned (outages) events.
Implementing availability involves:
- High availability architectures that includes clustering, redundancy and failover mechanisms.
- Resilient infrastructures that includes backup systems and geographically dispersed data centers.
- Robust incident and disaster response planning that includes COOP, DRP procedures and SLA targets.