Availability: Ensuring Access When You Need It

Protecting your data isn't just about keeping unauthorized people away from your private information – it's equally about ensuring that authorized people can access the data they need, when they need it. This is the principle of Availability, the third pillar of CyberSecurity alongside Confidentiality and Integrity.

We've all experienced situations where a server goes down, a USB drive fails, we can't remember our password or a cloud service becomes unavailable. When data becomes inaccessible, it can halt work, causing us to miss deadlines, and create other significant problems. A perfectly confidential and accurate file is worthless if you can't access it when required. Effective data access control is a combination of protecting data from unauthorized access, keeping it available to authorized users, clearly defining who falls into each category, and having the technical capability to enforce these decisions.

Forgetting passwords is one of the most common ways people lock themselves out of their own data. The solution is twofold: prevention and recovery planning.

Password Managers

Password managers are invaluable tools that securely store all your passwords in an encrypted vault, protected by one strong master password. This means you only need to remember one password instead of dozens. Popular options include Bitwarden (free option), 1Password, and LastPass. The master password needs to be memorable to you but difficult for others to guess. Of course, as the master password, you need to never lose it, although most Password Managers have an emergency recover system, which needs to be recorded and stored somewhere physically secure. In the very first course (CyberSecurity Starters) we explained one method of creating a strong and memorable password. Maybe now is a good time to glance back!

Account recovery options should be set up before you need them, not after you're locked out. When creating accounts, take the time to:

Add a recovery email address (preferably a personal email separate from work)
Set up security questions with answers you'll remember (or store the answers in a secure place), however the answers should also be obscure and not readily found on social media (as one example)
Save backup codes or recovery keys when offered, especially for important accounts
Enable multi-factor authentication (MFA), but also save backup authentication methods when offered by the MFA system

Account lockouts can occur when you enter the wrong password too many times. This security feature prevents brute-force attacks but can be frustrating when it's your own account. If you're unsure of your password, don't keep guessing – use the password reset or account recovery process instead. And remember: password reset links usually expire within a few hours, so act quickly when you receive them. Password reset links can be tricky as they also form a common Phishing technique, so only respond to links when you have asked for a password reset!

Balancing Access Control

Data access control is often a delicate balance between permitting and denying access. Tip too far in either direction and problems arise. Make access too restrictive, and authorized users can't do their jobs. Make it too permissive, and confidential data gets exposed to people who shouldn't see it. This balancing act is a common consequence of the CyberSecurity technique of least access – featured in a previous lesson.

Access control has some tricky facets where confidentiality and access collide. Consider this scenario: Billy, who works remotely, has legitimate access to a restricted document for a client project. However, Billy misses the team meeting where the document's confidential status is emphasized. Without understanding the sensitivity, Billy casually forwards the document to Robbi, a contractor who shouldn't have access to it. The access control system worked correctly – Billy was authorized – but the human element created a confidentiality breach. This illustrates why access controls must be paired with clear communication about data classification and handling requirements.

Managing Availability for Normal Users

While IT teams and technical teams handle many availability issues, as individual users, we can play a crucial role in ensuring access to data. Here are key responsibilities every user should take seriously:

Device maintenance matters. Keep your computer, phone, and tablet in good working order. Install updates when prompted (they often include stability fixes), don't ignore warnings about low disk space (full drives can crash systems), and address performance issues before they become critical. A poorly maintained device is a ticking time bomb for data access problems.

Organization is availability. Data you can't find might as well be unavailable. Develop a consistent system for naming and organizing your files. Use descriptive filenames, maintain a logical folder structure, and use search tags or metadata when available. "Document1_final_FINAL_v3.docx" scattered across your desktop isn't helping anyone, including future you.

Monitor your storage. Regularly check how much space you have available on your devices and cloud storage accounts. Running out of space can prevent you from saving new work, receiving emails, or syncing files. Delete old files you no longer need or move them to archive storage before you hit capacity limits. Deleting old files also can prevent data exposure and confidentiality breaches as we tend to forget what was in that old “Critical Information 2018.docx” document that was not considered private at the time, but is now considered Confidential.

Don't be the single point of failure. If you're the only person who knows where critical shared files are stored or how to access important systems, what happens when you're sick, on vacation, or leave the organization? Document important information, share knowledge with teammates, and ensure that emergency access procedures exist for situations when you're unavailable.

Verify your access regularly. Don't wait until you desperately need something to discover your access has been revoked or your password has expired. Periodically check that you can still access critical systems, especially after role changes, extended leave, or system updates. For example, test your VPN connection before you need to work remotely, not during an emergency or when you're already remote.

Keep software current. Using outdated software can create availability problems when you receive files in newer formats that won't open. While you don't need the latest version of everything immediately, being too many versions behind creates compatibility issues with colleagues and clients.

Practical Availability Considerations

Protecting data availability requires thinking through how and where people will access information:

Cloud storage services like Dropbox or OneDrive are only useful if users have internet connectivity. A document stored in OneDrive is inaccessible to someone working offline unless they've downloaded or synced it beforehand. Users need to plan ahead and sync critical files to their devices before traveling to areas with poor connectivity.
Sharing settings must be carefully configured. A restricted document uploaded to a publicly shared folder defeats the entire purpose of restricting it. It's surprisingly easy to accidentally grant "anyone with the link" access when you meant to restrict it to specific individuals.
Backup systems are essential for availability. If the only copy of important data exists on a single device or server, hardware failure means complete data loss. Regular backups to separate locations (following the "3-2-1 rule": 3 copies, 2 different media types, 1 offsite) ensure data remains available even when primary systems fail.
Redundancy and failover matter for critical systems. Organizations that can't afford downtime often implement redundant servers or cloud services that automatically take over if the primary system fails.

Take Away Actions for Availability

Moving from understanding to action, here are practical steps every user should take to protect availability:

Test your backups regularly. Having backups is pointless if you can't restore from them. At least once every few months, actually try recovering a file from your backup system. Can you navigate the restore process? Do you remember the password? Does the backup actually contain what you think it contains? Many people discover their backups weren't working only after they've lost data and it's too late.

Maintain multiple access methods. Don't put all your authentication eggs in one basket. If your only way to receive a login code is via your work mobile phone, what happens if the phone dies? Set up backup authentication methods: an authenticator app, backup codes saved in a secure place, or alternative contact methods. Just ensure these backup methods are also secure – writing codes on a sticky note defeats the purpose.

Keep offline access to critical information. Some information should be accessible even when systems are down. Consider keeping offline copies of:

Emergency contact numbers (IT support, key personnel)
Account recovery information (not passwords themselves, but what accounts you have and where)
Critical reference documents you might need immediately
Instructions for accessing backup systems

Store these securely but accessibly – a notebook in a locked drawer works better than an encrypted file you can't open because the system is down.

Know your escalation path. When systems are down or you're locked out, who do you contact? Don't wait for an emergency to find out. Know your IT helpdesk number, have it saved in your phone, and understand what issues they can resolve versus what requires higher-level support. Also know what's considered urgent versus what can wait – calling the emergency line because a non-critical file won't open at 2 AM won't make you popular.

Document your critical systems. Create a simple reference document listing:

What systems you regularly use
How to access them (not passwords, but URL, username format, etc.)
Who to contact if they're unavailable
Any special procedures or requirements

This isn't for sharing publicly, but for your own reference and potentially for someone covering your role. Update it whenever you gain or lose access to important systems.

Practice good password hygiene. Beyond using a password manager:

Never store your password only in the system it protects (you can't look it up if you can't log in)
Change passwords when prompted by IT, especially after security incidents
Don't share passwords verbally or via email
Use unique passwords for different systems (so compromising one doesn't compromise all)

Verify before assuming. If a system seems down, verify it's actually a system problem before spending hours troubleshooting your end. Check with colleagues, look for system status pages, or contact support. You might discover it's planned maintenance, not a problem to solve. Conversely, if you can't access something but others can, the problem is likely on your end – check your connection, your credentials, and your device before assuming the system is broken.

Threats to Availability

Several factors can compromise data availability:

Ransomware attacks that encrypt your data and demand payment for the decryption key
Denial of Service (DoS) attacks that overwhelm systems and make them unavailable
Hardware failures such as hard drive crashes or server malfunctions
Natural disasters like floods, fires, or power outages
Human error such as accidental deletion or misconfiguration
Software bugs or updates that cause system crashes or compatibility issues

Understanding these threats helps you plan appropriate protections, whether that's regular backups, redundant systems, or disaster recovery procedures.

Lesson 3 – Availability