Systems Maintenance Programs - The Forgotten Foundation and Support of the CIA Triad

Much has previously been written on the importance, relevance, and critical application of the CIA (Confidentiality, Integrity, Availability) Triad security model. However, operational emphasis on the CIA model has historically been placed primarily on 'hard' or widely addressed topics relating to prevention auditing and enforcement. This type of emphasis addresses issues such as policies and procedures training and awareness programs encryption access controls and hardware or software based security management tools. Where 'soft' issues such as maintenance procedures have been addressed as a security function it has been almost solely in the areas of Change Management. There are some areas of overlap however. Items such as backups and anti-virus protection are often addressed in both maintenance and security documents. What is usually not recognized is the symbiotic relationship between maintenance and security. A well engineered maintenance program that takes advantage of correlations between maintenance procedures and the CIA Triad will not only assist in operational readiness but can also provide an invaluable supplement and enhancement to any existing security program.