Which SDL security goal is defined as ensuring timely and reliable access to and use of information?

The question asks for the security goal defined as "ensuring timely and reliable access to and use of information." This is the standard definition of Availability, one of the three core components of the CIA (Confidentiality, Integrity, Availability) triad. Within a Security Development Lifecycle (SDL), Availability is a primary objective, ensuring that the software remains operational and accessible to authorized users as intended, resisting attacks like Denial of Service (DoS) that aim to disrupt its function.

A. Information security is the broad practice of protecting information and systems from unauthorized access, use, or disruption; it encompasses availability, not defines it.

B. Confidentiality is the security goal that prevents the unauthorized disclosure of sensitive information, ensuring data privacy.

D. Integrity is the security goal that ensures data is trustworthy and has not been altered or destroyed in an unauthorized manner.

1. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (Special Publication 800-53, Revision 5). U.S. Department of Commerce. In Appendix F, "Security and Privacy Control Baselines," page F-3, Availability is defined as: "Ensuring timely and reliable access to and use of information." This matches the question's definition verbatim.

Available at: https://doi.org/10.6028/NIST.SP.800-53r5

2. Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE, 63(9), 1278–1308. In Section I.A.1, "General Principles of Protection Mechanisms," page 1279, the paper outlines foundational security concepts, including availability, which it describes as ensuring the system's resources are usable and accessible when needed.

DOI: https://doi.org/10.1109/PROC.1975.9939

3. MIT OpenCourseWare. (2014). 6.858 Computer Systems Security, Fall 2014. Massachusetts Institute of Technology. In Lecture 1: Introduction & Threat Models, slide 10, the CIA triad is introduced. Availability is defined as "resistance to denial of service," which is a primary mechanism for ensuring timely and reliable access.

Available at: https://ocw.mit.edu/courses/6-858-computer-systems-security-fall-2014/resources/mit6858f14lec1/