Assets and Security Goals

## Why goals, not adjectives A threat model needs security **goals** — statements about the system that a concrete scenario could prove false. A **threat** is then a hypothesised way one of those goals comes out false. If your goal vocabulary is coarse, whole categories of threat have nowhere to land. Integrity, authenticity and non-repudiation are the three that get conflated most often, and each buys a different design. ## Integrity Integrity is a property of **the data or the computation**: it is what it was last legitimately made to be. A record that is byte-identical to what was written, a message that arrives as it was sent, a balance that only ever changed through an authorised operation. The violation is unauthorised modification — someone altered a stored filing, flipped a flag, reordered a queue, replayed a request so a transfer happened twice. Note what integrity says nothing about: **who** produced the data in the first place. An attacker who legitimately gets to write a record and writes something false has not broken integrity in this sense; the record faithfully holds what was submitted. That is a different problem, and it is why the next property exists. ## Authenticity Authenticity is a property of **origin**: the message, request or document really comes from the party it claims. The violation is impersonation — a forged instruction, a request that claims to be from the payments service and is not, a document that claims a signatory it never had. The two come apart in both directions, which is the point interviewers probe: - **Intact but forged.** A crafted instruction can be perfectly well-formed and unmodified in transit, and still originate from an impostor. Integrity holds; authenticity does not. - **Authentic but altered.** A message you know came from the right party, then modified downstream, has an authentic origin and broken integrity. In practice mechanisms often deliver both at once, which is exactly why people assume they are one property. In the model they must stay separate, because the threats and the assets differ: the loss from a forged instruction is not the loss from a corrupted archive. ## Non-repudiation Non-repudiation is about **evidence that persuades someone who was not there**. Authenticity asks: am I, the receiver, satisfied this came from you? Non-repudiation asks: could I convince a third party — an auditor, a court, an arbitration panel — that it came from you, over your denial? That extra requirement rules out whole classes of mechanism. If two parties share one secret and either could have produced the same evidence, the receiver is convinced but an outsider cannot tell which party acted. You have authenticity without non-repudiation. Non-repudiation needs evidence only one party could have created, and it needs the surrounding process — who held what, when, and how it was bound to an identity — to survive being questioned later. It is also the goal most often stated by accident. Teams write "we need an audit trail" — but an audit trail is a **control**, and stating it as the goal fixes the answer before you have asked the question. The goal is the outcome: the party who acted cannot credibly deny acting. Which mechanism achieves that is the next conversation, and keeping them separate is what lets you notice that the chosen mechanism does not. ## The neighbouring goals The same list normally carries three more properties: - **Confidentiality** — the data is not read by parties who should not read it. - **Availability** — the function is there when it is needed. For many systems this is the dominant goal, and a model that only writes confidentiality and integrity goals has structurally hidden it. - **Privacy** — whether collecting, linking, retaining or inferring about a person is legitimate at all. This is not a synonym for confidentiality: a system can keep data perfectly unread and still violate privacy by over-collecting or re-identifying, and its adversary is often a legitimate insider using legitimate access. Privacy as a full modelling discipline is its own method and its own topic. ## Using the distinction When you look at a design, name the property per asset rather than reciting the list. A public record system usually leads with authenticity and non-repudiation, because the content is meant to be readable and the loss is a fake or disowned entry. A commodity content service may lead with availability. A system holding trade secrets leads with confidentiality. The property you write down decides which threats survive triage, so getting the three apart is not vocabulary pedantry — it is what stops a whole class of threats from being invisible.