Fundamental concepts of information security

Information security, sometimes shortened to infosec, is the practice of protecting information by mitigating information risks. It is part of information risk management. It typically involves preventing or at least reducing the probability of unauthorized/inappropriate access, use, disclosure, disruption, deletion/destruction, corruption, modification, inspection, recording or devaluation, although it may also involve reducing the adverse impacts of incidents. Information may take any form, e.g. electronic or physical. Tangible (e.g. paperwork) or intangible (e.g. knowledge). Information security’s primary focus is the balanced protection of the confidentiality, integrity and availability of data (also known as the CIA triad) while maintaining a focus on efficient policy implementation, all without hampering organization productivity. This is largely achieved through a structured risk management process that involves:

• Identifying information and related assets, plus potential threats, vulnerabilities and impacts;
• Evaluating the risks;
• Deciding how to address or treat the risks i.e. to avoid, mitigate, share or accept them;
• Where risk mitigation is required, selecting or designing appropriate security controls and implementing them;
• Monitoring the activities, making adjustments as necessary to address any issues, changes and improvement opportunities.

To standardize this discipline, academics and professionals collaborate to offer guidance, policies, and industry standards on password, antivirus software, firewall, encryption software, legal liability, security awareness and training, and so forth. This standardization may be further driven by a wide variety of laws and regulations that affect how data is accessed, processed, stored, transferred and destroyed. However, the implementation of any standards and guidance within an entity may have limited effect if a culture of continual improvement isn’t adopted.

Responses to threats

Possible responses to a security threat or risk are:

Reduce/Mitigate: implement safeguards and countermeasures to eliminate vulnerabilities or block threats

Assign/Transfer: place the cost of the threat onto another entity or organization such as purchasing insurance or outsourcing

Accept: evaluate if the cost of the countermeasure outweighs the possible cost of loss due to the threat

Research has shown that the most vulnerable point in most information systems is the human user, operator, designer, or other human. The ISO/IEC 27002:2005 Code of practice for information security management recommends the following be examined during a risk assessment:

• Security policy,
• Organization of information security,
• Asset management,
• Human resources security,
• Physical and environmental security,
• Communications and operations management,
• Access control,
• Information systems acquisition, development and maintenance,
• Information security incident management,
• Business continuity management, and
• Regulatory compliance.

In broad terms, the risk management process consists of:

• Identification of assets and estimating their value. Include: people, buildings, hardware, software, data (electronic, print, other), supplies.
• Conduct a threat assessment. Include: Acts of nature, acts of war, accidents, malicious acts originating from inside or outside the organization.
• Conduct a vulnerability assessment, and for each vulnerability, calculate the probability that it will be exploited. Evaluate policies, procedures, standards, training, physical security, quality control, technical security.
• Calculate the impact that each threat would have on each asset. Use qualitative analysis or quantitative analysis.
• Identify, select and implement appropriate controls. Provide a proportional response. Consider productivity, cost effectiveness, and value of the asset.
• Evaluate the effectiveness of the control measures. Ensure the controls provide the required cost effective protection without discernible loss of productivity.