McCumber Cube
Field: Security
The McCumber Cube is an information security model that crosses three information states (transmission, storage, processing) with three security characteristics (confidentiality, integrity, availability) and three kinds of security measures (technology; policy and practice; education, training, and awareness), producing 27 cells that each describe an area a system must address.
The three dimensions
- Information states: at any given moment, information is being transmitted, stored, or processed. The states apply regardless of the medium the information is in.
- Critical information characteristics: confidentiality, integrity, and availability, the properties of the CIA triad.
- Security measures: technology; policy and practice; and education, training, and awareness.
This representation of the McCumber cube is available under the Creative Commons Attribution-Share Alike 3.0 Unported license. It appears of the Wikipedia entry for the McCumber cube.
The model is named for John R. McCumber, whose paper “Information Systems Security: A Comprehensive Model” appears in the proceedings of the 14th National Computer Security Conference (October 1991), published by NIST. The paper explains the states with an analogy to water, ice, and steam, and notes that processing requires its own controls because information must be available in plaintext, at least to the processor, while it is processed.
Relation to other terms
The information states correspond to the modern terms data in transit, data at rest, and data in use. The cube’s characteristics cover only the three CIA properties; the CIANA model adds non-repudiation and authentication.
Sources
- Proceedings of the 14th National Computer Security Conference, Volume 1 (McCumber, pp. 328–337), NIST Computer Security Resource Center, 1991. Retrieved September 24, 2026.
- McCumber cube, Wikipedia. Retrieved September 27, 2026.