TechKnowSurge
ISC2 CC 1.1 CompTIA Tech+ 6.1 Cisco CCST Cybersecurity 1.1 NIST NICE K0728
TechKnowSurge Catalog Videos Cybersecurity - Cybersecurity Cube
VideoSecurityFree

Cybersecurity - Cybersecurity Cube

The Cybersecurity Cube expands the CIA Triad into a three-dimensional framework by layering data states (at rest, in process, in transit) and the people, processes, and technology dimensions to produce 27 distinct security considerations. This structured model helps organizations systematically evaluate and address cybersecurity coverage across every relevant combination of factors.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

The CIA Triad establishes confidentiality, integrity, and availability as the three core objectives of cybersecurity, but those objectives alone do not account for the full complexity of securing data in a dynamic environment. Data is not static — it is stored, processed, and transmitted, each state presenting its own unique vulnerabilities. The Cybersecurity Cube addresses this by introducing data states as a second dimension, requiring that confidentiality, integrity, and availability each be evaluated separately for data at rest, data in process, and data in transit. For example, encrypting a database protects confidentiality at rest, while a VPN addresses confidentiality in transit — two distinct controls serving the same CIA objective at different points in the data lifecycle. The third dimension of the cube incorporates people, processes, and technology, commonly abbreviated as PPT. Technology refers to the specific tools and systems deployed, such as the choice between OpenVPN and Cisco AnyConnect. Processes cover the policies, procedures, and operational workflows that govern how those technologies are implemented and maintained, including how encryption algorithms are updated or how VPN certificates are distributed. People encompasses the individuals using and managing these systems, their training, their skill sets, and their potential as either a vulnerability or a strength within the security posture. Combining all three dimensions — three CIA objectives, three data states, and three PPT categories — produces 27 distinct areas of security consideration. This structure does not introduce new concerns so much as it provides a systematic methodology for working through existing ones without overlooking critical intersections. Rather than approaching cybersecurity as a broad and unwieldy challenge, the Cybersecurity Cube breaks it into manageable, well-defined components, enabling organizations to design security programs that are both thorough and logically organized.

What you'll learn

What's covered

Cybersecurity Cube

Aligned to

ISC2 CC
1.1 Understand cybersecurity concepts
CompTIA Tech+
6.1 Summarize confidentiality, integrity, and availability concerns
Cisco CCST Cybersecurity
1.1 Define essential security principles
NIST NICE
K0728 Knowledge of Confidentiality, Integrity and Availability (CIA) principles and practices

Key terms

CIA Triad
The three core principles of information security: Confidentiality, Integrity, and Availability.
Confidentiality
The principle that information is accessible only to those authorized to access it.
Integrity
The assurance that data has not been tampered with and remains accurate and complete.
Availability
The assurance that systems and data are accessible and operational when needed by authorized users.
Cybersecurity Cube
A three-dimensional framework that extends the CIA Triad by incorporating data states (at rest, in process, in transit) and Countermeasures (People, Processes, and Technology) to comprehensively evaluate security controls.
Data at Rest
Data that is stored on a device or medium and not actively moving through a network, which can be encrypted at the disk, partition, volume, file, or database level.
Data in Transit
Data that is actively moving across a network or communication channel between two endpoints, as opposed to data sitting on a storage device. Protocols such as TLS are commonly used to encrypt data in transit so it cannot be read if intercepted.
Data in Process
Data being actively used or computed by a processor, requiring decryption from memory to be handled and presenting the highest CPU performance cost of the three encryption states.
People, Processes, and Technology
PPT
The three elements that make up the Cybersecurity Cube's Countermeasures dimension: the human, procedural, and technical elements that must each be evaluated when applying security controls.

Topics

Cybersecurity Cube Cia Triad Data States Security Frameworks Cybersecurity

Transcript

Adding depth to the CIA Triad

We can actually add some depth to that CIA Triad model with the cybersecurity cube, so we can really evaluate cybersecurity and make sure that we cover all of our bases.

We already talked about the CIA Triad, that is confidentiality, keeping things secret; integrity, making sure that data doesn't change and that it's accurate; and then also availability, making sure that data or those services are up and running.

The states of data

When we think about confidentiality, integrity and availability, we have to think about the whole process, not just a single part of the process. That is, data is dynamic. It changes, it moves, it migrates. So how do we protect each one of those areas? We have to think about the states of data.

Let's take a very typical setup for, let's say, a web server. Let's say we have a bank of web servers here. A lot of times we don't actually store the data on those web servers, we store it on a separate database, so this is a database right here, and these web servers access this database. Let's say you're a client machine and you are requesting, maybe this is a banking site, you're remoting into your bank information here. The client gets to the web servers and requests the information. These web servers don't actually store the banking information on them, so they go to the database to grab the information from the database, they bring it in, they process it, and then send it to the client.

There are several states of where this data is living at this point in time, where it exists at this point in time. First of all, it's at rest on the database, and so we have to think about security from that standpoint, about what this data is doing at rest. And then it gets processed, so how are we going to secure those processes and make sure that that element is secure. And then it gets moved about, it's in transit, it goes to the client and then gets displayed on the client's machine, so how do we protect the data when it's in transit?

Thinking in a grid

So now we start thinking of things in a grid format. That is, how do we keep things confidential when it's at rest? How do we keep things confidential when it's in process? How do we keep things confidential when it's in transit? Same thing with integrity: how do we keep the integrity at rest, how do we keep the integrity when it's in process, what about in transit? So we can start checking each one of these boxes and thinking about each one of these boxes separately to make sure we've got this covered. So for instance, let's say we want to do encryption. We're going to encrypt things when they are at rest to keep things confidential, or maybe we use a VPN when it's in transit.

People, processes and technology

But we can also add a third dimension to this, and that is the people, processes and technology, or PPT. The people, processes and technology is a third dimension that we can look at to make sure that we're covering what we need to cover.

People are the people that you hire, the skill sets that they have, the abilities that they have. It can be a weak point or a strength for a company, and so that is the people side of this. And the people follow some sort of process, or hopefully they follow some sort of process. Hopefully there's some sort of guidelines, hopefully there's some guidance, some policies, some procedures that they follow, a playbook of sorts that they use to do their job. So that is the process part of that. And then there's the technology, the technologies they use.

We have to be thinking about vulnerabilities from each one of these standpoints. Are there vulnerabilities to the people side of this? Are there vulnerabilities to the process side? Or are there vulnerabilities to the technology side?

Where the cube comes into play

Here's where the cube comes into play, because now we can think about confidentiality, but instead of it being this humongous thing that we have to think about with all these different aspects, we can break it down into smaller components. How does confidentiality come when we're talking about data at rest, or how about data in process, or how about data in transit?

Not only that, but we can think about what technologies we implement for confidentiality when it's in transit. We already said confidentiality in transit is going to be a VPN, so we're going to use a VPN, but which technology? Let's do OpenVPN, or maybe it's going to be a Cisco AnyConnect. There are several different options that we have out there, but we're going to use a technology for that.

Then we have to think about our processes around that. Those technologies get old; we need to update OpenVPN now and then, we need to update our encryption algorithms now and then. So let's think about that cube right there, that process. How are we going to document that? How are we going to implement that? What do we need to think about from a process standpoint when it comes to rolling out these VPNs? Are we doing it with a certificate? Do we have to somehow have a process to hand out those certificates?

And then we think about the people side of this as well. When it comes to this solution, how are we going to train our people to use VPN? How are we going to train them to set up VPN, or are we going to use the IT department to help them set up the VPN?

So there are a lot of different aspects to think about, and what this does is allow us to more comprehensively think about this process. We've got three dimensions to do that. One, we've got confidentiality, integrity and availability, so there's three options there. We've got our at rest, in process and in transit, so 3 x 3, that's nine. And then we've got our people, processes and technology, so 9 x 3, that's 27. So there are 27 areas that we can think about. They are areas that we already had to think about, but now we have this methodology of logically going through and making sure we have all the bases covered along the way.

So that is the cybersecurity cube, and it allows us to take that comprehensive look at cybersecurity and make sure that we roll out a well-designed cybersecurity program.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →