How a 1991 model still guides organizations in protecting everything from databases to IoT sensors.
In 1991, John McCumber proposed a three-dimensional model that remains one of the clearest frameworks for evaluating an organization’s security posture. Known as the McCumber Cube, it asks security teams to consider three overlapping dimensions simultaneously: the foundational security principles, the states that data exists in, and the countermeasures available.
Confidentiality
- Sensitive information is disclosed only to authorized parties. Achieved through encryption, identity proofing, and two-factor authentication.
Integrity
- Information and processes are protected from unauthorized modification. Hash functions and checksums verify that data has not been tampered with.
Availability
- Authorized users can access systems and data when needed. Maintained through hardware upkeep, software updates, and reliable backups.
Data also exists in three distinct states, each requiring different protections. Data in process is actively being used — for example, a database record being updated. Data at rest lives on hard drives, USB drives, and solid-state storage. Data in transit travels between systems over networks. A robust security strategy must address all three.
Awareness & Training
- Users who understand threats are an organization’s first line of defence against social engineering and phishing.
Technology
- Firewalls, intrusion detection systems, and encryption tools provide automated, continuous protection of information systems.
Policy & Procedure
- Incident response plans and best-practice guidelines form the administrative backbone of an organization’s security posture.
Traditional organizational data — transactional records, intellectual property, financial statements — has always required protection. The emergence of the Internet of Things has added an exponential layer of complexity. IoT connects sensors, software, and physical equipment to the internet, generating vast streams of data stored in the cloud. This “Big Data” expansion means the McCumber Cube applies to a far larger, more diffuse attack surface than its creator could have imagined in 1991.
See you on the next one 🙂
