What does ‘available’ mean in information security?

In information security, the term ‘available’ refers to the third pillar of the CIA triad: availability. Availability means that information and systems are accessible to authorised users and can be used when they are needed, and that data is not lost or rendered inaccessible by unforeseen events or attacks.

What exactly does ‘availability’ mean?

The availability of information and IT systems is a fundamental principle of information security and means that systems, networks, applications and data are accessible and functional at all times – especially at times when they are needed by authorised users.

A loss of availability can result in important business processes being interrupted, leading to financial losses, reputational damage and even legal consequences.

How is availability ensured in information security?

Various strategies and measures are used to ensure the availability of systems and data:

1. Redundancy:

• Redundant systems (e.g. additional servers, networks or power supply units) are used to ensure that if one system fails, another can take over. This reduces the risk of outages and increases system availability.
• Geographic redundancy: Data is often backed up in different geographic locations to ensure high availability of data in the event of physical damage (e.g. due to natural disasters).

1. Backups:

• Regular data backups ensure that data can be restored after an outage or disaster. There are various backup strategies (e.g. full backups, incremental backups) that ensure that data is not lost in the event of an outage.
• Cloud backups or offsite backups can also be used to store data in a secure, offsite location.

1. Minimise disruptions:

• Error detection and troubleshooting are important to ensure the availability of systems and data. Automated systems for monitoring IT infrastructures can help to identify problems early and fix them before they lead to a complete failure.

1. Disaster recovery (DR):

• A well-thought-out disaster recovery plan ensures that a company can quickly get back up and running in the event of a major disruption or disaster. DR strategies include the recovery of IT infrastructure, data and applications, as well as communication with stakeholders.

1. Load balancing:

• Load balancing distributes data traffic and requests across multiple servers or systems so that no single resource is overloaded and the availability of services remains guaranteed even when demand is high.

1. Security against DoS/DDoS attacks:

• Distributed Denial of Service (DDoS) attacks can severely impair the availability of systems and services by overwhelming the server with a flood of requests. Protective measures such as firewalls, intrusion detection systems (IDS), DDoS protection solutions and content delivery networks (CDNs) help to ward off such attacks and ensure availability.

1. Access control and authentication:

• Access control and authentication ensure that only authorised users can access systems and data, while availability of the systems for authorised users is guaranteed. This prevents unauthorised access attempts from impacting availability.

1. Software and system updates:

• Regular software updates and patch management help to close security gaps and prevent system-related failures due to bugs or security vulnerabilities. This helps to ensure that systems remain stable and available.

Examples of the importance of availability:

1. Banks and financial systems:
   Banks and financial institutions must ensure that their online banking systems, payment systems and point-of-sale systems are available at all times. A failure of these systems could result in financial losses and customer satisfaction issues.
2. E-commerce platforms:
   An online store must be available 24/7 to process orders and serve customers. A downtime during the sales period could significantly impact sales and damage the company’s reputation.
3. Healthcare:
   In hospitals or medical facilities, the availability of patient data and medical equipment is critical. A failure could lead to incorrect treatment or even endanger lives.
4. Cloud services:
   Cloud service providers such as Amazon Web Services (AWS), Microsoft Azure or Google Cloud must ensure that their services are available at all times. A failure could result in business interruptions and financial losses for their customers.

Risks of lack of availability:

• Business interruption:
  When systems are unavailable, businesses cannot carry out their daily tasks. In critical sectors (e.g. healthcare, finance, energy supply), this can have serious consequences.
• Damage to reputation:
  A failure of systems or services often results in a loss of trust among customers, partners and other stakeholders, which can cause long-term reputational damage.
• Financial losses:
  Every hour of system downtime can result in significant financial losses for companies and organisations, especially in revenue-generating areas such as e-commerce.
• Legal and regulatory consequences:
  In some industries (e.g. financial services or healthcare), there are legal requirements that demand a certain level of availability of systems and data. A breach of these requirements can lead to legal consequences, such as fines or claims for damages.

Conclusion:

In information security, availability means that systems, networks and data are accessible to authorised users at all times when they need them. The aim is to ensure that outages, disruptions and data loss are minimised and that contingency plans (such as backups and disaster recovery strategies) are in place to ensure the availability of information and services. Availability is essential to the smooth running of organisations and to maintaining the trust of customers and users.