Why some cybersecurity professionals tend to dismiss the availability responsibility?

The cybersecurity triad, also known as the CIA triad, is a model that outlines the three primary goals of information security:

• Confidentiality: Protecting sensitive information from unauthorized access, use, disclosure, modification, or destruction.
• Integrity: Ensuring that data is accurate, complete, and not modified without authorization.
• Availability: Ensuring that data and systems are accessible and usable when needed.

These three components are considered the foundation of a robust cybersecurity strategy, as they work together to protect an organization's information assets from various types of threats and risks.

Some cybersecurity professionals may tend to dismiss the Availability responsibility for a few reasons:

•  Historical focus on confidentiality : In the past, the primary focus of cybersecurity was on protecting sensitive information from unauthorized access, which led to a strong emphasis on confidentiality. As a result, some professionals may have developed a mindset that prioritizes confidentiality over other aspects of the triad.
•  Perception of availability as an IT issue : Availability is often seen as an IT operations or infrastructure concern, rather than a core cybersecurity responsibility. This perception can lead some cybersecurity professionals to view availability as someone else's problem.
•  Lack of clear ownership : In some organizations, the responsibility for ensuring availability may not be clearly defined or assigned, leading to a lack of ownership and accountability.
•  Difficulty in measuring availability : Unlike confidentiality and integrity, which can be measured through metrics such as data breaches or unauthorized access attempts, availability can be more challenging to quantify. This can make it harder for cybersecurity professionals to prioritize and address availability concerns.
•  Overemphasis on threat prevention : Some cybersecurity professionals may focus primarily on preventing threats, rather than ensuring the continued availability of systems and data. This can lead to a neglect of availability responsibilities.

However, it's essential to recognize that availability is a critical aspect of the cybersecurity triad, and neglecting it can have significant consequences, such as downtime, lost productivity, and reputational damage.